diff options
| author | Ashok Raj <ashok.raj@oss.qualcomm.com> | 2026-09-11 14:53:04 -0700 |
|---|---|---|
| committer | Dave Jiang <dave.jiang@intel.com> | 2026-09-17 20:05:17 -0700 |
| commit | c1031c2474f73261d8d5e4deef2b5dc20fb964f5 (patch) | |
| tree | 7014b799a3b3a66eb2d68afa7a47e83d4d90b0e8 | |
| parent | 17ff3a9fd8669ea53fe83a7013871f30214d5537 (diff) | |
| download | linux-next-c1031c2474f73261d8d5e4deef2b5dc20fb964f5.tar.gz linux-next-c1031c2474f73261d8d5e4deef2b5dc20fb964f5.zip | |
cxl/features: Ensure that count is set before access to ent[] __counted_by()
get_supported_features() assigns entries->num_features only after the
memcpy() loop that fills entries->ent[] has already run. Since ent[]
is __counted_by(num_features), the compiler's bounds instrumentation
sees a 0-length array during that loop and FORTIFY_SOURCE trips on
the memcpy. Set @num_features right after allocation, before any
write into ent[], so the bound is correct for the whole lifetime of
the array.
This was found via a fortify panic:
memcpy: detected buffer overflow: 384 byte write of buffer size 0
WARNING: lib/string_helpers.c:1035 at __fortify_report+0x54/0xa0
kernel BUG at lib/string_helpers.c:1043!
Call trace:
__fortify_panic+0x10/0x18
get_supported_features.isra.0+0x4a0/0x4d0 [cxl_core]
devm_cxl_setup_features+0x84/0x120 [cxl_core]
cxl_pci_probe+0x254/0x5e0 [cxl_pci]
Same class of bug, same fix shape as commit 6c9d2e87df40
("cxl/fwctl: Fix __fortify_panic"), which fixed the analogous issue
in cxlctl_get_supported_features() but missed this one.
[ dj: Fixed up title typo per Jonathan. ]
Fixes: f0e6a2329bf9 ("cxl: Add Get Supported Features command for kernel usage")
Signed-off-by: Ashok Raj <ashok.raj@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260911215304.1816467-1-ashok.raj@oss.qualcomm.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
| -rw-r--r-- | drivers/cxl/core/features.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 95f47193fb61..8024c2dcae1d 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -97,6 +97,7 @@ get_supported_features(struct cxl_features_state *cxlfs) kvmalloc_flex(*entries, ent, count); if (!entries) return NULL; + entries->num_features = count; struct cxl_mbox_get_sup_feats_out *mbox_out __free(kvfree) = kvmalloc(cxl_mbox->payload_size, GFP_KERNEL); @@ -174,7 +175,6 @@ get_supported_features(struct cxl_features_state *cxlfs) start += num_entries; } while (remain_feats); - entries->num_features = count; entries->num_user_features = user_feats; return no_free_ptr(entries); |