From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-20.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6598EC4320E for ; Fri, 23 Jul 2021 03:58:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4EB2260ED7 for ; Fri, 23 Jul 2021 03:58:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233721AbhGWDRb (ORCPT ); Thu, 22 Jul 2021 23:17:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:37266 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233769AbhGWDRH (ORCPT ); Thu, 22 Jul 2021 23:17:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7D3FC60E9C; Fri, 23 Jul 2021 03:57:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1627012661; bh=bNmhk1dCWlP014YFke38+oz54ZQ9+wuW83V6snIsmYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cTjpURdeBsbO0jTvi7CCpGwCisKDtZyhWM3IkLVOoJdqHRkZNhlGFxiszynvSzfs0 WZjkt7XV3SNlsqDckmWRtPZJchO6P1OlLQu22c0FCrioiKIg4jl91UA+BhVuLKFGZ5 aPrU7cHV7N4J72IU880x1Jf8pJvHQknwYDmA2e3YyO4WViY8CluagBuydIv/yEIVU0 +pL30vADTyTNOz+kjEBq8K12BnYGSOVVUfXtpYhQt38ZAc4bacJGIcwvh7tvy1ZlKe Y5RdChjf6p1ksn4Eab7NJWKQo5SjXgOILogLAzk0BM7mLx3Lo0zidjNYxEXoELdwFT 97v4vw+r7YWCw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sudeep Holla , kernel test robot , Dan Carpenter , Cristian Marussi , Sasha Levin , linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.13 14/19] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Date: Thu, 22 Jul 2021 23:57:15 -0400 Message-Id: <20210723035721.531372-14-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210723035721.531372-1-sashal@kernel.org> References: <20210723035721.531372-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sudeep Holla [ Upstream commit 7a691f16ccad05d770f813d9c4b4337a30c6d63f ] The scmi_linux_errmap buffer access index is supposed to depend on the array size to prevent element out of bounds access. It uses SCMI_ERR_MAX to check bounds but that can mismatch with the array size. It also changes the success into -EIO though scmi_linux_errmap is never used in case of success, it is expected to work for success case too. It is slightly confusing code as the negative of the error code is used as index to the buffer. Fix it by negating it at the start and make it more readable. Link: https://lore.kernel.org/r/20210707135028.1869642-1-sudeep.holla@arm.com Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/driver.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 66eb3f0e5daf..ce81ed053876 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -47,7 +47,6 @@ enum scmi_error_codes { SCMI_ERR_GENERIC = -8, /* Generic Error */ SCMI_ERR_HARDWARE = -9, /* Hardware Error */ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */ - SCMI_ERR_MAX }; /* List of all SCMI devices active in system */ @@ -166,8 +165,10 @@ static const int scmi_linux_errmap[] = { static inline int scmi_to_linux_errno(int errno) { - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) - return scmi_linux_errmap[-errno]; + int err_idx = -errno; + + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) + return scmi_linux_errmap[err_idx]; return -EIO; } -- 2.30.2 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FE4EC4338F for ; Fri, 23 Jul 2021 03:59:38 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 556A560EC0 for ; Fri, 23 Jul 2021 03:59:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 556A560EC0 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=uCGJ1TTtX6wjvkC2TlQ4dfKsvV15FdgthKIY7FufAmk=; b=DIUaYZIbwC22JM R08EhsMt+fZt7Yg3OILwKH8JfNcEDIai+Kr+eYzzpZv8BqwQoGyKMN0Zr4PwceNVp1sTEiZXu6t1a i+Oi2Px9M3Cv7YiN2i3nW1r/rfugGlH2HnpXr0ex+ZQRPPnWCnudzJEF0iAyAndpeViCLcotwM2KG wDulZ7YPMZH+fM54b/K8WlYM6Fys4JRgQF9q17IqJmTCpgls/JnJGhx6QByktkrqS7bSZeg4eDeUr z6nRUKO8X8FY2UWnPrIZwnT1eyPLvkPkwN9yurT90jbGbrCcDe2vfI5+/VnLbxQ8mCK1gwB59QyZ6 oncrVpzXbNPC/duhaquA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1m6mJq-003D7I-SC; Fri, 23 Jul 2021 03:57:51 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1m6mJh-003D0n-K0 for linux-arm-kernel@lists.infradead.org; Fri, 23 Jul 2021 03:57:43 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7D3FC60E9C; Fri, 23 Jul 2021 03:57:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1627012661; bh=bNmhk1dCWlP014YFke38+oz54ZQ9+wuW83V6snIsmYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cTjpURdeBsbO0jTvi7CCpGwCisKDtZyhWM3IkLVOoJdqHRkZNhlGFxiszynvSzfs0 WZjkt7XV3SNlsqDckmWRtPZJchO6P1OlLQu22c0FCrioiKIg4jl91UA+BhVuLKFGZ5 aPrU7cHV7N4J72IU880x1Jf8pJvHQknwYDmA2e3YyO4WViY8CluagBuydIv/yEIVU0 +pL30vADTyTNOz+kjEBq8K12BnYGSOVVUfXtpYhQt38ZAc4bacJGIcwvh7tvy1ZlKe Y5RdChjf6p1ksn4Eab7NJWKQo5SjXgOILogLAzk0BM7mLx3Lo0zidjNYxEXoELdwFT 97v4vw+r7YWCw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sudeep Holla , kernel test robot , Dan Carpenter , Cristian Marussi , Sasha Levin , linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.13 14/19] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Date: Thu, 22 Jul 2021 23:57:15 -0400 Message-Id: <20210723035721.531372-14-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210723035721.531372-1-sashal@kernel.org> References: <20210723035721.531372-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210722_205741_720659_2D66D730 X-CRM114-Status: GOOD ( 13.80 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Sudeep Holla [ Upstream commit 7a691f16ccad05d770f813d9c4b4337a30c6d63f ] The scmi_linux_errmap buffer access index is supposed to depend on the array size to prevent element out of bounds access. It uses SCMI_ERR_MAX to check bounds but that can mismatch with the array size. It also changes the success into -EIO though scmi_linux_errmap is never used in case of success, it is expected to work for success case too. It is slightly confusing code as the negative of the error code is used as index to the buffer. Fix it by negating it at the start and make it more readable. Link: https://lore.kernel.org/r/20210707135028.1869642-1-sudeep.holla@arm.com Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/driver.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 66eb3f0e5daf..ce81ed053876 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -47,7 +47,6 @@ enum scmi_error_codes { SCMI_ERR_GENERIC = -8, /* Generic Error */ SCMI_ERR_HARDWARE = -9, /* Hardware Error */ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */ - SCMI_ERR_MAX }; /* List of all SCMI devices active in system */ @@ -166,8 +165,10 @@ static const int scmi_linux_errmap[] = { static inline int scmi_to_linux_errno(int errno) { - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) - return scmi_linux_errmap[-errno]; + int err_idx = -errno; + + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) + return scmi_linux_errmap[err_idx]; return -EIO; } -- 2.30.2 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel