• Stefan Wahren's avatar
    ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init · 72ad3b77
    Stefan Wahren authored
    Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
    with enabled CONFIG_UBSAN triggers the following warning:
    
     UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
     index 2 is out of range for type 'sunxi_mc_smp_data [2]'
     CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cb
     Hardware name: BCM2835
      unwind_backtrace from show_stack+0x10/0x14
      show_stack from dump_stack_lvl+0x40/0x4c
      dump_stack_lvl from ubsan_epilogue+0x8/0x34
      ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
      __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
      sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
      do_one_initcall from kernel_init_freeable+0xf4/0x2f4
      kernel_init_freeable from kernel_init+0x18/0x158
      kernel_init from ret_from_fork+0x14/0x28
    
    Since the enabled method couldn't match with any entry from
    sunxi_mc_smp_data, the value of the index shouldn't be used right after
    the loop. So move it after the check of ret in order to have a valid
    index.
    
    Fixes: 1631090e ("ARM: sun9i: smp: Add is_a83t field")
    Signed-off-by: default avatarStefan Wahren <wahrenst@gmx.net>
    Link: https://lore.kernel.org/r/20231228193903.9078-1-wahrenst@gmx.netReviewed-by: default avatarChen-Yu Tsai <wens@csie.org>
    Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
    72ad3b77
mc_smp.c 24.5 KB