From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22261C07E9B for ; Wed, 7 Jul 2021 14:08:02 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DF2F761C73 for ; Wed, 7 Jul 2021 14:08:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DF2F761C73 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Ntqe4C5DGGgFCiMzzVX11Ogw6pDNmv9KpM7IJ6CWtZk=; b=wqcn3av0hGuthS 6/45E/GN/HiZJwLoAKK29OKiwyOe65MYTGysRzTP3zaHb8qtz3GP8V4D9ywBoQ3CPLACNqL/GqBJ8 cyHhvXc7qwzX+JUfq3C+BVWB8A+emchFOnuk39QgGXMPJ8cCtUW93Q86lB4/v2KOf6eomMl2IO/uX L4FDhX9WHbLESNcxAoJSZtbWsIz7Z1nztZo8sGWyroxxg5NfkowYGrURYRj64h2k2ImJMyluJuCbX Pu3LX1EQWdB+r9mVeWqnvJ6pMKIMqFe2Z50QOPUuX4UJxJg/gIrtup+p+17FP6GBC3I9Ep7GUtMpo kygmvdCEnFNkLsnod8Iw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1m18CD-00F1Gy-D5; Wed, 07 Jul 2021 14:06:37 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1m18C9-00F1GK-Nx for linux-arm-kernel@lists.infradead.org; Wed, 07 Jul 2021 14:06:35 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id A5F61D6E; Wed, 7 Jul 2021 07:06:28 -0700 (PDT) Received: from e120937-lin (unknown [172.31.20.19]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id E3AFA3F73B; Wed, 7 Jul 2021 07:06:27 -0700 (PDT) Date: Wed, 7 Jul 2021 15:06:25 +0100 From: Cristian Marussi To: Sudeep Holla Cc: linux-arm-kernel@lists.infradead.org, kernel test robot , Dan Carpenter Subject: Re: [PATCH] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Message-ID: <20210707140625.GI17807@e120937-lin> References: <20210707135028.1869642-1-sudeep.holla@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20210707135028.1869642-1-sudeep.holla@arm.com> User-Agent: Mutt/1.9.4 (2018-02-28) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210707_070633_872612_D3FFD938 X-CRM114-Status: GOOD ( 24.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Jul 07, 2021 at 02:50:28PM +0100, Sudeep Holla wrote: > The scmi_linux_errmap buffer access index is supposed to depend on the > array size to prevent element out of bounds access. It uses SCMI_ERR_MAX > to check bounds but that can mismatch with the array size. It also > changes the success into -EIO though scmi_linux_errmap is never used in > case of success, it is expected to work for success case too. > > It is slightly confusing code as the negative of the error code > is used as index to the buffer. Fix it by negating it at the start and > make it more readable. > > Reported-by: kernel test robot > Reported-by: Dan Carpenter > Signed-off-by: Sudeep Holla > --- > drivers/firmware/arm_scmi/driver.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > (Based on https://lore.kernel.org/r/20210707134739.1869481-1-sudeep.holla@arm.com) > > diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c > index 66e5e694be7d..2a5c1b3658c4 100644 > --- a/drivers/firmware/arm_scmi/driver.c > +++ b/drivers/firmware/arm_scmi/driver.c > @@ -166,8 +166,10 @@ static const int scmi_linux_errmap[] = { > > static inline int scmi_to_linux_errno(int errno) > { > - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) > - return scmi_linux_errmap[-errno]; > + int err_idx = -errno; > + > + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) > + return scmi_linux_errmap[err_idx]; > return -EIO; > } > Hi, Looks good to me; now SCMI_ERR_MAX is not referenced anymore by anyone but I suppose is good practice to still keep it as an end-marker for scmi_error_codes enum. Reviewed-by: Cristian Marussi Thanks, Cristian > -- > 2.25.1 > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel