Skip to content

Commit

Permalink
cxl/pci: Handle excessive CDAT length
Browse files Browse the repository at this point in the history
If the length in the CDAT header is larger than the concatenation of the
header and all table entries, then the CDAT exposed to user space
contains trailing null bytes.

Not every consumer may be able to handle that.  Per Postel's robustness
principle, "be liberal in what you accept" and silently reduce the
cached length to avoid exposing those null bytes.

Fixes: c970060 ("cxl/port: Read CDAT table")
Tested-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: stable@vger.kernel.org # v6.0+
Link: https://lore.kernel.org/r/6d98b3c7da5343172bd3ccabfabbc1f31c079d74.1678543498.git.lukas@wunner.de
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
  • Loading branch information
l1k authored and djbw committed Apr 3, 2023
1 parent b56faef commit 4fe2c13
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/cxl/core/pci.c
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,9 @@ static int cxl_cdat_read_table(struct device *dev,
}
} while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY);

/* Length in CDAT header may exceed concatenation of CDAT entries */
cdat->length -= length;

return 0;
}

Expand Down

0 comments on commit 4fe2c13

Please sign in to comment.