Re: [PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-17 Thread Stefano Brivio
Jeff, Dave, This is a pretty bad issue as one can crash a kernel quite easily by forcing interrupt affinity changes. We now have three versions of this patch, with exactly the same code changes. I posted mine as I independently found this issue last week and didn't notice Juergen patch which was

Re: [PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-16 Thread Stefano Brivio
On Thu, 17 Aug 2017 03:01:09 +0200 Stefano Brivio wrote: > Before posting, however, I checked patchwork at: > > https://patchwork.ozlabs.org/project/intel-wired-lan/list/ > > and also your git tree (listed in MAINTAINERS) at: > > git://git.kernel.org/pub/scm/linux/kernel/git/jkirsh

Re: [PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-16 Thread Stefano Brivio
Hi Jeff, On Wed, 16 Aug 2017 17:25:24 -0700 Jeff Kirsher wrote: > On Tue, 2017-08-15 at 12:30 +0200, Stefano Brivio wrote: > > The cpumask used in i40e{,vf}_irq_affinity_notify() is allocated > > by irq_affinity_notify() with alloc_cpumask_var(), which doesn't > > allocate NR_CPUS bits, but only

Re: [PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-16 Thread Jeff Kirsher
On Tue, 2017-08-15 at 12:30 +0200, Stefano Brivio wrote: > The cpumask used in i40e{,vf}_irq_affinity_notify() is allocated > by irq_affinity_notify() with alloc_cpumask_var(), which doesn't > allocate NR_CPUS bits, but only nr_cpumask_bits bits. If we just > dereference it, we'll read way more tha

Re: [PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-15 Thread Stefano Brivio
On Tue, 15 Aug 2017 12:30:14 +0200 Stefano Brivio wrote: > The cpumask used in i40e{,vf}_irq_affinity_notify() is allocated > by irq_affinity_notify() with alloc_cpumask_var(), which doesn't > allocate NR_CPUS bits, but only nr_cpumask_bits bits. If we just > dereference it, we'll read way more t

[PATCH] i40e{,vf}: Fix out-of-bound cpumask read in IRQ affinity handler

2017-08-15 Thread Stefano Brivio
The cpumask used in i40e{,vf}_irq_affinity_notify() is allocated by irq_affinity_notify() with alloc_cpumask_var(), which doesn't allocate NR_CPUS bits, but only nr_cpumask_bits bits. If we just dereference it, we'll read way more than what is allocated, e.g. 1024 bytes vs. 8 bytes allocated on x86