[PATCH V2 1/2] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init

[PATCH V2 1/2] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init

[Stefan Wahren]

Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
with enabled CONFIG_UBSAN triggers the following warning:

 UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
 index 2 is out of range for type 'sunxi_mc_smp_data [2]'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
 Hardware name: BCM2835
  unwind_backtrace from show_stack+0x10/0x14
  show_stack from dump_stack_lvl+0x40/0x4c
  dump_stack_lvl from ubsan_epilogue+0x8/0x34
  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
  __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
  sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
  do_one_initcall from kernel_init_freeable+0xf4/0x2f4
  kernel_init_freeable from kernel_init+0x18/0x158
  kernel_init from ret_from_fork+0x14/0x28

Since the enabled method couldn't match with any entry from
sunxi_mc_smp_data, the value of the index shouldn't be used right after
the loop. So move it after the check of ret in order to have a valid
index.

Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
Changes in V2:
- append another patch to fix return code check

 arch/arm/mach-sunxi/mc_smp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index cb63921232a6..6ec3445f3c72 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -807,12 +807,12 @@ static int __init sunxi_mc_smp_init(void)
 			break;
 	}

-	is_a83t = sunxi_mc_smp_data[i].is_a83t;
-
 	of_node_put(node);
 	if (ret)
 		return -ENODEV;

+	is_a83t = sunxi_mc_smp_data[i].is_a83t;
+
 	if (!sunxi_mc_smp_cpu_table_init())
 		return -EINVAL;

--
2.34.1

[PATCH V2 2/2] ARM: sun9i: smp: fix return code check of of_property_match_string

[Stefan Wahren]

of_property_match_string returns an int; either an index from 0 or
greater if successful or negative on failure. Even it's very
unlikely that the DT CPU node contains multiple enable-methods
these checks should be fixed.

This patch was inspired by the work of Nick Desaulniers.

Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
Cc: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/mach-sunxi/mc_smp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index 6ec3445f3c72..277f6aa8e6c2 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -803,12 +803,12 @@ static int __init sunxi_mc_smp_init(void)
 	for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) {
 		ret = of_property_match_string(node, "enable-method",
 					       sunxi_mc_smp_data[i].enable_method);
-		if (!ret)
+		if (ret >= 0)
 			break;
 	}

 	of_node_put(node);
-	if (ret)
+	if (ret < 0)
 		return -ENODEV;

 	is_a83t = sunxi_mc_smp_data[i].is_a83t;
--
2.34.1

Re: [PATCH V2 1/2] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init

[patchwork-bot+linux-soc]

Hello:

This series was applied to soc/soc.git (arm/fixes)
by Arnd Bergmann <arnd@arndb.de>:

On Thu, 28 Dec 2023 20:39:02 +0100 you wrote:
> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
> with enabled CONFIG_UBSAN triggers the following warning:
> 
>  UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
>  index 2 is out of range for type 'sunxi_mc_smp_data [2]'
>  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
>  Hardware name: BCM2835
>   unwind_backtrace from show_stack+0x10/0x14
>   show_stack from dump_stack_lvl+0x40/0x4c
>   dump_stack_lvl from ubsan_epilogue+0x8/0x34
>   ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
>   __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
>   sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
>   do_one_initcall from kernel_init_freeable+0xf4/0x2f4
>   kernel_init_freeable from kernel_init+0x18/0x158
>   kernel_init from ret_from_fork+0x14/0x28
> 
> [...]

Here is the summary with links:
  - [V2,1/2] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
    https://git.kernel.org/soc/soc/c/e7322fcaacef
  - [V2,2/2] ARM: sun9i: smp: fix return code check of of_property_match_string
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH V2 1/2] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init

[Chen-Yu Tsai]

On Fri, Dec 29, 2023 at 3:39 AM Stefan Wahren <wahrenst@gmx.net> wrote:
>
> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
> with enabled CONFIG_UBSAN triggers the following warning:
>
>  UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
>  index 2 is out of range for type 'sunxi_mc_smp_data [2]'
>  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
>  Hardware name: BCM2835
>   unwind_backtrace from show_stack+0x10/0x14
>   show_stack from dump_stack_lvl+0x40/0x4c
>   dump_stack_lvl from ubsan_epilogue+0x8/0x34
>   ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
>   __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
>   sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
>   do_one_initcall from kernel_init_freeable+0xf4/0x2f4
>   kernel_init_freeable from kernel_init+0x18/0x158
>   kernel_init from ret_from_fork+0x14/0x28
>
> Since the enabled method couldn't match with any entry from
> sunxi_mc_smp_data, the value of the index shouldn't be used right after
> the loop. So move it after the check of ret in order to have a valid
> index.
>
> Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
> Signed-off-by: Stefan Wahren <wahrenst@gmx.net>

Reviewed-by: Chen-Yu Tsai <wens@csie.org>

> ---
> Changes in V2:
> - append another patch to fix return code check
>
>  arch/arm/mach-sunxi/mc_smp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
> index cb63921232a6..6ec3445f3c72 100644
> --- a/arch/arm/mach-sunxi/mc_smp.c
> +++ b/arch/arm/mach-sunxi/mc_smp.c
> @@ -807,12 +807,12 @@ static int __init sunxi_mc_smp_init(void)
>                         break;
>         }
>
> -       is_a83t = sunxi_mc_smp_data[i].is_a83t;
> -
>         of_node_put(node);
>         if (ret)
>                 return -ENODEV;
>
> +       is_a83t = sunxi_mc_smp_data[i].is_a83t;
> +
>         if (!sunxi_mc_smp_cpu_table_init())
>                 return -EINVAL;
>
> --
> 2.34.1
>

Re: [PATCH V2 2/2] ARM: sun9i: smp: fix return code check of of_property_match_string

[Chen-Yu Tsai]

On Fri, Dec 29, 2023 at 3:39 AM Stefan Wahren <wahrenst@gmx.net> wrote:
>
> of_property_match_string returns an int; either an index from 0 or
> greater if successful or negative on failure. Even it's very
> unlikely that the DT CPU node contains multiple enable-methods
> these checks should be fixed.
>
> This patch was inspired by the work of Nick Desaulniers.
>
> Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
> Cc: Nick Desaulniers <ndesaulniers@google.com>
> Signed-off-by: Stefan Wahren <wahrenst@gmx.net>

Reviewed-by: Chen-Yu Tsai <wens@csie.org>

Arnd, would it be possible to apply the two fixes directly to the soc tree?

Thanks.

> ---
>  arch/arm/mach-sunxi/mc_smp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
> index 6ec3445f3c72..277f6aa8e6c2 100644
> --- a/arch/arm/mach-sunxi/mc_smp.c
> +++ b/arch/arm/mach-sunxi/mc_smp.c
> @@ -803,12 +803,12 @@ static int __init sunxi_mc_smp_init(void)
>         for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) {
>                 ret = of_property_match_string(node, "enable-method",
>                                                sunxi_mc_smp_data[i].enable_method);
> -               if (!ret)
> +               if (ret >= 0)
>                         break;
>         }
>
>         of_node_put(node);
> -       if (ret)
> +       if (ret < 0)
>                 return -ENODEV;
>
>         is_a83t = sunxi_mc_smp_data[i].is_a83t;
> --
> 2.34.1
>

Re: [PATCH V2 2/2] ARM: sun9i: smp: fix return code check of of_property_match_string

[Arnd Bergmann]

On Tue, Jan 2, 2024, at 15:59, Chen-Yu Tsai wrote:
> On Fri, Dec 29, 2023 at 3:39 AM Stefan Wahren <wahrenst@gmx.net> wrote:
>>
>> of_property_match_string returns an int; either an index from 0 or
>> greater if successful or negative on failure. Even it's very
>> unlikely that the DT CPU node contains multiple enable-methods
>> these checks should be fixed.
>>
>> This patch was inspired by the work of Nick Desaulniers.
>>
>> Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
>> Cc: Nick Desaulniers <ndesaulniers@google.com>
>> Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
>
> Reviewed-by: Chen-Yu Tsai <wens@csie.org>
>
> Arnd, would it be possible to apply the two fixes directly to the soc tree?

Yes, I've merged them into the arm/fixes branch now. These
are currently the only fixes I have queued up but I should
be able to send them before the v6.7 release.

   Arnd