From: Florian Fainelli <f.fainelli@gmail.com>
To: ndesaulniers@google.com, Chen-Yu Tsai <wens@csie.org>,
Jernej Skrabec <jernej.skrabec@gmail.com>,
Samuel Holland <samuel@sholland.org>,
"William (Zhenghao) Zhang" <william.zhang@broadcom.com>
Cc: Russell King <linux@armlinux.org.uk>,
Arnd Bergmann <arnd@arndb.de>,
linux-arm-kernel@lists.infradead.org,
linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] ARM: sunxi: fix return code check of of_property_match_string
Date: Tue, 16 May 2023 11:34:08 -0700 [thread overview]
Message-ID: <f099e6e0-d1c6-9d72-0d16-2712286be67d@gmail.com> (raw)
In-Reply-To: <20230516-sunxi-v1-1-ac4b9651a8c1@google.com>
[-- Attachment #1: Type: text/plain, Size: 1612 bytes --]
+William,
On 5/16/23 09:35, ndesaulniers@google.com wrote:
> of_property_match_string returns an int; either an index from 0 or
> greater if successful or negative on failure.
>
> Fixes the following splat observed with UBSAN:
> [ 0.166489][ T1] UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
> [ 0.166934][ T1] index 2 is out of range for type 'sunxi_mc_smp_data [2]'
> [ 0.167206][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.4.0-rc2 #1
> [ 0.167515][ T1] Hardware name: Generic DT based system
> [ 0.167727][ T1] unwind_backtrace from show_stack+0x18/0x1c
> [ 0.167979][ T1] show_stack from dump_stack_lvl+0x68/0x90
> [ 0.168226][ T1] dump_stack_lvl from ubsan_epilogue+0x8/0x34
> [ 0.168474][ T1] ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
> [ 0.168760][ T1] __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe8/0x574
> [ 0.169100][ T1] sunxi_mc_smp_init from do_one_initcall+0x178/0x9c8
> [ 0.169364][ T1] do_one_initcall from kernel_init_freeable+0x1dc/0x28c
> [ 0.169661][ T1] kernel_init_freeable from kernel_init+0x20/0x164
> [ 0.169912][ T1] kernel_init from ret_from_fork+0x14/0x2c
>
> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
William had a similar fix submitted back in September of last year, but
I do not believe it got applied either:
https://lore.kernel.org/r/20220929012944.454613-1-william.zhang@broadcom.com
lore was not able to find it, but above is the message ID, and attached
is his original patch.
--
Florian
[-- Attachment #2: [PATCH] ARM: sun9i: smp: fix out-of-bounds access error - William Zhang <william.zhang@broadcom.com> - 2022-09-28 1829.eml --]
[-- Type: application/x-extension-eml, Size: 13548 bytes --]
next prev parent reply other threads:[~2023-05-16 18:34 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-16 16:35 [PATCH] ARM: sunxi: fix return code check of of_property_match_string ndesaulniers
2023-05-16 18:34 ` Florian Fainelli [this message]
2023-05-22 19:55 ` Nick Desaulniers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f099e6e0-d1c6-9d72-0d16-2712286be67d@gmail.com \
--to=f.fainelli@gmail.com \
--cc=arnd@arndb.de \
--cc=jernej.skrabec@gmail.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sunxi@lists.linux.dev \
--cc=linux@armlinux.org.uk \
--cc=ndesaulniers@google.com \
--cc=samuel@sholland.org \
--cc=wens@csie.org \
--cc=william.zhang@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).