Merge: CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1080

JIRA: https://issues.redhat.com/browse/RHEL-99005
CVE: CVE-2025-21991

```
commit e3e8917
Author: Florent Revest <revest@chromium.org>
Date:   Mon Mar 10 15:42:43 2025 +0100

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

    Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their
    CPU masks and unconditionally accesses per-CPU data for the first CPU of each
    mask.

    According to Documentation/admin-guide/mm/numaperf.rst:

      "Some memory may share the same node as a CPU, and others are provided as
      memory only nodes."

    Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".

    On a machine with far memory (and therefore CPU-less NUMA nodes):
    - cpumask_of_node(nid) is 0
    - cpumask_first(0) is CONFIG_NR_CPUS
    - cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an
      index that is 1 out of bounds

    This does not have any security implications since flashing microcode is
    a privileged operation but I believe this has reliability implications by
    potentially corrupting memory while flashing a microcode update.

    When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes
    a microcode update. I get the following splat:

      UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y
      index 512 is out of range for type 'unsigned long[512]'
      [...]
      Call Trace:
       dump_stack
       __ubsan_handle_out_of_bounds
       load_microcode_amd
       request_microcode_amd
       reload_store
       kernfs_fop_write_iter
       vfs_write
       ksys_write
       do_syscall_64
       entry_SYSCALL_64_after_hwframe

    Change the loop to go over only NUMA nodes which have CPUs before determining
    whether the first CPU on the respective node needs microcode update.

      [ bp: Massage commit message, fix typo. ]

    Fixes: 7ff6edf ("x86/microcode/AMD: Fix mixed steppings support")
    Signed-off-by: Florent Revest <revest@chromium.org>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20250310144243.861978-1-revest@chromium.org
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-06-23 12:40 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>

Author: CKI KWF Bot

arch/x86/kernel/cpu/microcode/amd.c

@@ -994,7 +994,7 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz
 	if (ret != UCODE_OK)
 		return ret;
 
-	for_each_node(nid) {
+	for_each_node_with_cpus(nid) {
 		cpu = cpumask_first(cpumask_of_node(nid));
 		c = &cpu_data(cpu);