[PATCH] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

[Will Deacon]

On Thu, Jan 23, 2025 at 01:11:59PM -0500, Radu Rendec wrote:
> diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
> index d9c9218fa1fdd..77ffda7284754 100644
> --- a/arch/arm64/kernel/cacheinfo.c
> +++ b/arch/arm64/kernel/cacheinfo.c
> @@ -101,16 +101,18 @@ int populate_cache_leaves(unsigned int cpu)
>  	unsigned int level, idx;
>  	enum cache_type type;
>  	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
> -	struct cacheinfo *this_leaf = this_cpu_ci->info_list;
> +	struct cacheinfo *infos = this_cpu_ci->info_list;
>  
>  	for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
> -	     idx < this_cpu_ci->num_leaves; idx++, level++) {
> +	     idx < this_cpu_ci->num_leaves; level++) {
>  		type = get_cache_type(level);
>  		if (type == CACHE_TYPE_SEPARATE) {
> -			ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
> -			ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
> +			if (idx + 2 > this_cpu_ci->num_leaves)
> +				break;

Why are you checking 'idx + 2' rather than 'idx + 1'?

Will