2
0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
linux/arch/x86/kernel/cpu
Florent Revest e3e89178a9 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their
CPU masks and unconditionally accesses per-CPU data for the first CPU of each
mask.

According to Documentation/admin-guide/mm/numaperf.rst:

  "Some memory may share the same node as a CPU, and others are provided as
  memory only nodes."

Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".

On a machine with far memory (and therefore CPU-less NUMA nodes):
- cpumask_of_node(nid) is 0
- cpumask_first(0) is CONFIG_NR_CPUS
- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an
  index that is 1 out of bounds

This does not have any security implications since flashing microcode is
a privileged operation but I believe this has reliability implications by
potentially corrupting memory while flashing a microcode update.

When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes
a microcode update. I get the following splat:

  UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y
  index 512 is out of range for type 'unsigned long[512]'
  [...]
  Call Trace:
   dump_stack
   __ubsan_handle_out_of_bounds
   load_microcode_amd
   request_microcode_amd
   reload_store
   kernfs_fop_write_iter
   vfs_write
   ksys_write
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

Change the loop to go over only NUMA nodes which have CPUs before determining
whether the first CPU on the respective node needs microcode update.

  [ bp: Massage commit message, fix typo. ]

Fixes: 7ff6edf4fe ("x86/microcode/AMD: Fix mixed steppings support")
Signed-off-by: Florent Revest <revest@chromium.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250310144243.861978-1-revest@chromium.org
2025-03-10 16:02:54 +01:00
..
mce x86/mce/amd: Remove shared threshold bank plumbing 2025-01-03 19:05:35 +01:00
microcode x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes 2025-03-10 16:02:54 +01:00
mtrr x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() 2024-12-04 10:46:19 -08:00
resctrl - Remove the less generic CPU matching infra around struct x86_cpu_desc and 2025-01-21 09:30:59 -08:00
sgx x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled 2025-03-10 12:29:18 +01:00
.gitignore
acrn.c x86/traps: Add sysvec_install() to install a system interrupt handler 2024-01-31 22:02:36 +01:00
amd.c - Remove the less generic CPU matching infra around struct x86_cpu_desc and 2025-01-21 09:30:59 -08:00
aperfmperf.c x86/sched: Add basic support for CPU capacity scaling 2024-09-04 13:36:40 +02:00
bugs.c x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit 2025-02-11 10:07:52 -08:00
bus_lock.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
cacheinfo.c x86/cacheinfo: Validate CPUID leaf 0x2 EDX output 2025-03-04 09:59:14 +01:00
centaur.c x86/cpu: Use common topology code for Centaur and Zhaoxin 2024-02-15 22:07:37 +01:00
common.c - Remove the less generic CPU matching infra around struct x86_cpu_desc and 2025-01-21 09:30:59 -08:00
cpu.h x86/topology/intel: Unlock CPUID before evaluating anything 2024-05-31 20:25:56 +02:00
cpuid-deps.c x86/cpufeatures: Make AVX-VNNI depend on AVX 2025-02-21 14:19:16 +01:00
cyrix.c x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems 2025-02-25 22:44:01 +01:00
debugfs.c x86/topology: Introduce topology_logical_core_id() 2024-12-02 12:01:35 +01:00
feat_ctl.c x86/cpu: Clarify the error message when BIOS does not support SGX 2024-08-25 14:41:19 +02:00
hygon.c x86/cpu: Use common topology code for HYGON 2024-02-15 22:07:38 +01:00
hypervisor.c
intel_epb.c x86/cpu/intel_epb: Switch to new Intel CPU model defines 2024-04-29 10:31:16 +02:00
intel.c x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 2025-03-04 09:59:14 +01:00
Makefile x86/split_lock: Move Split and Bus lock code to a dedicated file 2024-08-08 18:02:15 +02:00
match.c Miscellaneous x86 cleanups and typo fixes, and also the removal 2025-01-21 11:15:29 -08:00
mkcapflags.sh x86/cpufeatures: Flip the /proc/cpuinfo appearance logic 2024-06-20 21:04:22 +02:00
mshyperv.c hyperv: Switch from hyperv-tlfs.h to hyperv/hvhdk.h 2025-01-10 00:54:21 +00:00
perfctr-watchdog.c
powerflags.c
proc.c x86/cpu: Use str_yes_no() helper in show_cpuinfo_misc() 2024-10-26 15:37:15 +02:00
rdrand.c x86/msr: Prepare for including <linux/percpu.h> into <asm/msr.h> 2024-03-04 12:01:39 +01:00
scattered.c x86/cpu: Fix formatting of cpuid_bits[] in scattered.c 2024-10-28 13:51:05 +01:00
topology_amd.c x86/cpu: Add CPU type to struct cpuinfo_topology 2024-10-25 20:44:26 +02:00
topology_common.c x86/topology: Introduce topology_logical_core_id() 2024-12-02 12:01:35 +01:00
topology_ext.c x86/cpu/topology: Add support for the AMD 0x80000026 leaf 2024-03-22 11:22:14 +01:00
topology.c Merge branch 'linus' into x86/cleanups, to resolve conflict 2024-12-10 19:33:03 +01:00
topology.h x86/cpu/topology: Retrieve cores per package from topology bitmaps 2024-02-15 22:07:45 +01:00
transmeta.c
tsx.c x86/cpu: Remove redundant extern x86_read_arch_cap_msr() 2023-01-10 12:40:24 +01:00
umc.c
umwait.c x86/umwait: move to use bus_get_dev_root() 2023-03-17 15:29:29 +01:00
vmware.c x86/vmware: Add TDX hypercall support 2024-06-25 17:15:48 +02:00
vortex.c x86/CPU: Add support for Vortex CPUs 2021-10-21 15:49:07 +02:00
zhaoxin.c x86/cpu: Use common topology code for Centaur and Zhaoxin 2024-02-15 22:07:37 +01:00