This is a note to let you know that I've just added the patch titled
cxl/pci: Handle excessive CDAT length
to the 6.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cxl-pci-handle-excessive-cdat-length.patch
and it can be found in the queue-6.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 4fe2c13d59d849be3b45371e3913ec5dc77fc0fb Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@xxxxxxxxx>
Date: Sat, 11 Mar 2023 15:40:04 +0100
Subject: cxl/pci: Handle excessive CDAT length
From: Lukas Wunner <lukas@xxxxxxxxx>
commit 4fe2c13d59d849be3b45371e3913ec5dc77fc0fb upstream.
If the length in the CDAT header is larger than the concatenation of the
header and all table entries, then the CDAT exposed to user space
contains trailing null bytes.
Not every consumer may be able to handle that. Per Postel's robustness
principle, "be liberal in what you accept" and silently reduce the
cached length to avoid exposing those null bytes.
Fixes: c97006046c79 ("cxl/port: Read CDAT table")
Tested-by: Ira Weiny <ira.weiny@xxxxxxxxx>
Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
Reviewed-by: Dan Williams <dan.j.williams@xxxxxxxxx>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx # v6.0+
Link: https://lore.kernel.org/r/6d98b3c7da5343172bd3ccabfabbc1f31c079d74.1678543498.git.lukas@xxxxxxxxx
Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/cxl/core/pci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -582,6 +582,9 @@ static int cxl_cdat_read_table(struct de
}
} while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY);
+ /* Length in CDAT header may exceed concatenation of CDAT entries */
+ cdat->length -= length;
+
return 0;
}
Patches currently in stable-queue which might be from lukas@xxxxxxxxx are
queue-6.2/pci-doe-fix-memory-leak-with-config_debug_objects-y.patch
queue-6.2/cxl-pci-handle-truncated-cdat-entries.patch
queue-6.2/cxl-pci-handle-truncated-cdat-header.patch
queue-6.2/cxl-pci-fix-cdat-retrieval-on-big-endian.patch
queue-6.2/pci-doe-silence-warn-splat-with-config_debug_objects-y.patch
queue-6.2/cxl-pci-handle-excessive-cdat-length.patch
