diff options
| author | Richard Cheng <icheng@nvidia.com> | 2026-06-26 18:41:00 +0800 |
|---|---|---|
| committer | Dave Jiang <dave.jiang@intel.com> | 2026-07-14 13:32:03 -0700 |
| commit | 4bf6bac375076ced2fa4b3fef8739bd985f93456 (patch) | |
| tree | e768d6ebba9745837aceb28a70c75f898407d556 | |
| parent | a623128bc2a1c257cbad97d0582f355fbe7be927 (diff) | |
| download | linux-4bf6bac375076ced2fa4b3fef8739bd985f93456.tar.gz linux-4bf6bac375076ced2fa4b3fef8739bd985f93456.zip | |
cxl/features: Reject Get Feature count larger than the output buffer
cxlctl_get_feature() sizes its output buffer from the user's
fwctl_rpc.out_len, but the device is told to write
cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a
separate user-controlled value. Nothing bounds count against out_len, so
a small out_len with a large count overflows the kvzalloc()'d buffer.
A heap OOB write reachable from FWCTL_RPC.
Reject requests where count exceeds the available payload room, before
allocating.
Fixes: 5908f3ed6dc2 ("cxl: Add support to handle user feature commands for get feature")
Reviewed-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Koba Ko <kobak@nvidia.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260626104102.53892-2-icheng@nvidia.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
| -rw-r--r-- | drivers/cxl/core/features.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 8731b95dd0b5..d50e6b58d8fd 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -474,6 +474,10 @@ static void *cxlctl_get_feature(struct cxl_features_state *cxlfs, if (!count) return ERR_PTR(-EINVAL); + if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload) || + count > out_size - offsetof(struct fwctl_rpc_cxl_out, payload)) + return ERR_PTR(-EINVAL); + struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) = kvzalloc(out_size, GFP_KERNEL); if (!rpc_out) |