Messages in this thread Patch in this message | | | From | Chen Jun <> | Subject | [PATCH] arm64/smp: check !ipi_desc[i] in arch_show_interrupts | Date | Fri, 27 May 2022 08:22:36 +0000 |
| |
There is a potential dereferencing null pointer issue in arch_show_interrupts.
Problem 1: int arch_show_interrupts(struct seq_file *p, int prec) for (i = 0; i < NR_IPI; i++) { seq_printf(p, "%10u ", irq_desc_kstat_cpu(ipi_desc[i], cpu));
Only ipi_desc[0..nr_ipi - 1] are initialized in set_smp_ipi_range. and ipi_desc[nr_ipi..NR_IPI] are NULL. irq_desc_kstat_cpu will dereference NULL pointer. For now, the problem can not be triggered, because NR_IPI is always equal to nr_ipi.
Problem 2: If request_percpu_irq failed in set_smp_ipi_range, ipi_desc[i] would be NULL. irq_desc_kstat_cpu will dereference NULL pointer.
check !ipi_desc[i] (as arm does) to avoid the problem.
Signed-off-by: Chen Jun <chenjun102@huawei.com> --- arch/arm64/kernel/smp.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index 62ed361a4376..3d54f464428b 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -781,6 +781,9 @@ int arch_show_interrupts(struct seq_file *p, int prec) unsigned int cpu, i; for (i = 0; i < NR_IPI; i++) { + if (!ipi_desc[i]) + continue; + seq_printf(p, "%*s%u:%s", prec - 1, "IPI", i, prec >= 4 ? " " : ""); for_each_online_cpu(cpu) -- 2.17.1
| |