[PATCH 0/2] platform/x86: ISST: Two ioctl input validation fixes

[HyeongJun An]

Two out-of-bounds accesses reachable from the ISST character device
ioctls, both from user-supplied index values that are not bounded before
use.

The first is an off-by-one on socket_id in the CLOS association ioctl,
plus a missing NULL check on the resulting instance pointer. The same
file already gets both of these right in get_instance(), which rejects
pkg_id with in_range(pkg_id, 0, topology_max_packages()) and then checks
the instance for NULL before returning it.

The second is a missing level bound in the two perf-mask ioctls. The
four adjacent helpers that read the same per-level register block all
reject a level above max_level first.

Neither path is behind CAP_SYS_ADMIN. Commit 69cd1ca440a9 ("platform/x86:
ISST: Check for admin capability for write commands") describes
deployments that relax the permissions on /dev/isst_interface so that
non-root users can read SST capabilities, and deliberately gates only the
write commands.

Found by inspection, not reproduced on hardware.

HyeongJun An (2):
  platform/x86: ISST: Validate socket ID in clos_assoc ioctl
  platform/x86: ISST: Validate level in perf mask ioctls

 .../x86/intel/speed_select_if/isst_tpmi_core.c      | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

-- 
2.43.0