diff options
| author | Lukas Wunner <lukas@wunner.de> | 2023-03-11 17:40:02 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-04-13 17:55:25 +0300 |
| commit | ff7edd1ac6435b98c8db0f144d04946d2b3e99b0 (patch) | |
| tree | ab66a76607de9a5364ecb5ff87c6739963c41486 /drivers/cxl | |
| parent | 021544721f493c3f73fb42fabd7681b78a07c725 (diff) | |
| download | linux-ff7edd1ac6435b98c8db0f144d04946d2b3e99b0.tar.xz | |
cxl/pci: Handle truncated CDAT header
commit 34bafc747c54fb58c1908ec3116fa6137393e596 upstream.
cxl_cdat_get_length() only checks whether the DOE response size is
sufficient for the Table Access response header (1 dword), but not the
succeeding CDAT header (1 dword length plus other fields).
It thus returns whatever uninitialized memory happens to be on the stack
if a truncated DOE response with only 1 dword was received. Fix it.
Fixes: c97006046c79 ("cxl/port: Read CDAT table")
Reported-by: Ming Li <ming4.li@intel.com>
Tested-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Ming Li <ming4.li@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: stable@vger.kernel.org # v6.0+
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/r/000e69cd163461c8b1bc2cf4155b6e25402c29c7.1678543498.git.lukas@wunner.de
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/cxl')
| -rw-r--r-- | drivers/cxl/core/pci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c index c17f3c066fa2..a091f954dec4 100644 --- a/drivers/cxl/core/pci.c +++ b/drivers/cxl/core/pci.c @@ -531,7 +531,7 @@ static int cxl_cdat_get_length(struct device *dev, return rc; } wait_for_completion(&t.c); - if (t.task.rv < sizeof(__le32)) + if (t.task.rv < 2 * sizeof(__le32)) return -EIO; *length = le32_to_cpu(t.response_pl[1]); |