From nobody Tue Dec 30 12:50:53 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C144C2BB3F for ; Wed, 15 Nov 2023 15:13:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344430AbjKOPNk (ORCPT ); Wed, 15 Nov 2023 10:13:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344433AbjKOPNc (ORCPT ); Wed, 15 Nov 2023 10:13:32 -0500 Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DA8A498 for ; Wed, 15 Nov 2023 07:13:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1700061208; x=1731597208; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=OnPaiXAOhBiP6LV5TOJMCST2i8qrHexK4o80WvI5Yj4=; b=MLtaG8GqhlK1+qC/0+hn5DR5b/hMeomAjzBalbmC5Rp45QF8dqwI7hVa Q65vsDcch/QMu2PVRhBllEnirfAo8LKT5njN9rFGbO1D7gox7Gx/mS5PE i/XQwu/8RzZ2I5AqwUavGhqturXHH/7i9LPrQgjS31UIhMpqZ4Te7iec4 fH25bHWNZnKDr2VTMs2jSTjvLpLhn5GOMpG5Edlt/hpUQHJcGrGb1UoV2 ndfuFUiDxQVMI2VTk5w1trjqZt9V3q4tqc6DFFoqMVka2pAolQXkiaWgR ObEmeAhZDgrEYQHogyZNF+1l3sBjHDMcXLuBMza0R09k2kAF1A8OJ8xQl g==; X-IronPort-AV: E=McAfee;i="6600,9927,10895"; a="393747736" X-IronPort-AV: E=Sophos;i="6.03,305,1694761200"; d="scan'208";a="393747736" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2023 07:13:28 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10895"; a="765005022" X-IronPort-AV: E=Sophos;i="6.03,305,1694761200"; d="scan'208";a="765005022" Received: from jfdev013vml03.jf.intel.com ([10.165.161.72]) by orsmga002.jf.intel.com with ESMTP; 15 Nov 2023 07:13:28 -0800 From: alexander.antonov@linux.intel.com To: peterz@infradead.org, linux-kernel@vger.kernel.org Cc: kyle.meyer@hpe.com, kan.liang@linux.intel.com, alexey.v.bayduraev@linux.intel.com, alexander.antonov@linux.intel.com Subject: [PATCH] perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Date: Wed, 15 Nov 2023 07:13:27 -0800 Message-Id: <20231115151327.1874060-1-alexander.antonov@linux.intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Antonov The NULL dereference happens inside upi_fill_topology() procedure in case of disabling one of the sockets on the system. For example, if you disable the 2nd socket on a 4-socket system then uncore_max_dies() returns 3 and inside pmu_alloc_topology() memory will be allocated only for 3 sockets and stored in type->topology. In discover_upi_topology() memory is accessed by socket id from CPUNODEID registers which contain physical ids (from 0 to 3) and on the line: =C2=A0 =C2=A0 upi =3D &type->topology[nid][idx]; out-of-bound access will happen and the 'upi' pointer will be passed to upi_fill_topology() where it will be dereferenced. To avoid this issue update the code to convert physical socket id to logical socket id in discover_upi_topology() before accessing memory. Fixes: f680b6e6062e ("perf/x86/intel/uncore: Enable UPI topology discovery = for Icelake Server") Reported-by: Kyle Meyer Tested-by: Kyle Meyer Signed-off-by: Alexander Antonov --- arch/x86/events/intel/uncore_snbep.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/u= ncore_snbep.c index 8250f0f59c2b..49bc27ab26ad 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -5596,7 +5596,7 @@ static int discover_upi_topology(struct intel_uncore_= type *type, int ubox_did, i struct pci_dev *ubox =3D NULL; struct pci_dev *dev =3D NULL; u32 nid, gid; - int i, idx, ret =3D -EPERM; + int i, idx, lgc_pkg, ret =3D -EPERM; struct intel_uncore_topology *upi; unsigned int devfn; =20 @@ -5614,8 +5614,13 @@ static int discover_upi_topology(struct intel_uncore= _type *type, int ubox_did, i for (i =3D 0; i < 8; i++) { if (nid !=3D GIDNIDMAP(gid, i)) continue; + lgc_pkg =3D topology_phys_to_logical_pkg(i); + if (lgc_pkg < 0) { + ret =3D -EPERM; + goto err; + } for (idx =3D 0; idx < type->num_boxes; idx++) { - upi =3D &type->topology[nid][idx]; + upi =3D &type->topology[lgc_pkg][idx]; devfn =3D PCI_DEVFN(dev_link0 + idx, ICX_UPI_REGS_ADDR_FUNCTION); dev =3D pci_get_domain_bus_and_slot(pci_domain_nr(ubox->bus), ubox->bus->number, @@ -5626,6 +5631,7 @@ static int discover_upi_topology(struct intel_uncore_= type *type, int ubox_did, i goto err; } } + break; } } err: base-commit: 9bacdd8996c77c42ca004440be610692275ff9d0 --=20 2.25.1