tree dfb2dfef390e34f8cbf62bde7406e72d43f004c5
parent 2846820de635813ea583c72e839fa5fde4a9baee
author Radu Rendec <rrendec@redhat.com> 1738863860 -0500
committer Arnav Kansal <rnv@google.com> 1742073078 -0700

arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

[ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ]

The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information")

BUG=b/403502363
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2025-21785 in the Linux kernel.

cos-patch: security-high
Change-Id: I87cff00aa1df457ba41ff05aedf4298fb143d1ba
Signed-off-by: Radu Rendec <rrendec@redhat.com>
Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/96095
Reviewed-by: Shuo Yang <gshuoy@google.com>
Reviewed-by: Arnav Kansal <rnv@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>