| From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001 |
| From: Alexander Shishkin <alexander.shishkin@linux.intel.com> |
| Date: Wed, 17 Apr 2019 10:35:35 +0300 |
| Subject: stm class: Fix channel bitmap on 32-bit systems |
| |
| From: Alexander Shishkin <alexander.shishkin@linux.intel.com> |
| |
| commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream. |
| |
| Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace |
| Module devices") naively calculates the channel bitmap size in 64-bit |
| chunks regardless of the size of underlying unsigned long, making the |
| bitmap half as big on a 32-bit system. This leads to an out of bounds |
| access with the upper half of the bitmap. |
| |
| Fix this by using BITS_TO_LONGS. While at it, convert to using |
| struct_size() for the total size calculation of the master struct. |
| |
| Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> |
| Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices") |
| Reported-by: Mulu He <muluhe@codeaurora.org> |
| Cc: stable@vger.kernel.org # v4.4+ |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/hwtracing/stm/core.c | 7 +++---- |
| 1 file changed, 3 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/hwtracing/stm/core.c |
| +++ b/drivers/hwtracing/stm/core.c |
| @@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig |
| static int stp_master_alloc(struct stm_device *stm, unsigned int idx) |
| { |
| struct stp_master *master; |
| - size_t size; |
| |
| - size = ALIGN(stm->data->sw_nchannels, 8) / 8; |
| - size += sizeof(struct stp_master); |
| - master = kzalloc(size, GFP_ATOMIC); |
| + master = kzalloc(struct_size(master, chan_map, |
| + BITS_TO_LONGS(stm->data->sw_nchannels)), |
| + GFP_ATOMIC); |
| if (!master) |
| return -ENOMEM; |
| |
