[PATCH] platform/x86/intel/ifs: fix slab OOB in ifs_pkg_auth indexing

[Haoran Wang]

scan_chunks_sanity_check() indexes the per-package boolean array
ifs_pkg_auth with topology_physical_package_id(cpu).

    curr_pkg = topology_physical_package_id(cpu);
    if (ifs_pkg_auth[curr_pkg])
        continue;
    ...
    ifs_pkg_auth[curr_pkg] = 1;

But ifs_pkg_auth is allocated and zeroed by topology_max_packages()
(core.c:128, load.c:330), the count of *logical* packages, and its valid
indices form a contiguous range 0..N-1.  topology_physical_package_id()
returns the HW physical package id, which may be non-contiguous (e.g. on
VMware VMM or any platform/firmware that assigns non-contiguous APIC
package ids).  When a physical id >= N, the read (load.c:344) and write
(load.c:355) go out of bounds.

Use topology_logical_package_id(cpu) instead, which returns a contiguous
0..N-1 range matching the allocation.  This is the same fix already
applied to the ISST driver in the same subsystem, which uses
topology_logical_package_id() for its per-package array
(drivers/platform/x86/intel/speed_select_if/isst_if_common.c:301).

Signed-off-by: Haoran Wang <haoranwangsec@xxxxxxxxx>
---
 drivers/platform/x86/intel/ifs/load.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/ifs/load.c b/drivers/platform/x86/intel/ifs/load.c
index 50f1fdf7d..1563b47e7 100644
--- a/drivers/platform/x86/intel/ifs/load.c
+++ b/drivers/platform/x86/intel/ifs/load.c
@@ -340,7 +340,7 @@ static int scan_chunks_sanity_check(struct device *dev)
 	/* copy the scan hash and authenticate per package */
 	cpus_read_lock();
 	for_each_online_cpu(cpu) {
-		curr_pkg = topology_physical_package_id(cpu);
+		curr_pkg = topology_logical_package_id(cpu);
 		if (ifs_pkg_auth[curr_pkg])
 			continue;
 		reinit_completion(&ifs_done);