diff mbox series

ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init

Message ID 20231223123546.88125-1-wahrenst@gmx.net (mailing list archive)
State New, archived
Headers show
Series ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init | expand

Commit Message

Stefan Wahren Dec. 23, 2023, 12:35 p.m. UTC
Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
with enabled CONFIG_UBSAN triggers the following warning:

 UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
 index 2 is out of range for type 'sunxi_mc_smp_data [2]'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
 Hardware name: BCM2835
  unwind_backtrace from show_stack+0x10/0x14
  show_stack from dump_stack_lvl+0x40/0x4c
  dump_stack_lvl from ubsan_epilogue+0x8/0x34
  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
  __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
  sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
  do_one_initcall from kernel_init_freeable+0xf4/0x2f4
  kernel_init_freeable from kernel_init+0x18/0x158
  kernel_init from ret_from_fork+0x14/0x28

Since the enabled method couldn't match with any entry from
sunxi_mc_smp_data, the value of the index shouldn't be used right after
the loop. So move it after the check of ret in order to have a valid
index.

Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/mach-sunxi/mc_smp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--
2.34.1

Comments

Florian Fainelli Dec. 24, 2023, 10:12 a.m. UTC | #1
On 12/23/2023 1:35 PM, Stefan Wahren wrote:
> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
> with enabled CONFIG_UBSAN triggers the following warning:
> 
>   UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
>   index 2 is out of range for type 'sunxi_mc_smp_data [2]'
>   CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
>   Hardware name: BCM2835
>    unwind_backtrace from show_stack+0x10/0x14
>    show_stack from dump_stack_lvl+0x40/0x4c
>    dump_stack_lvl from ubsan_epilogue+0x8/0x34
>    ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
>    __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
>    sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
>    do_one_initcall from kernel_init_freeable+0xf4/0x2f4
>    kernel_init_freeable from kernel_init+0x18/0x158
>    kernel_init from ret_from_fork+0x14/0x28
> 
> Since the enabled method couldn't match with any entry from
> sunxi_mc_smp_data, the value of the index shouldn't be used right after
> the loop. So move it after the check of ret in order to have a valid
> index.
> 
> Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
> Signed-off-by: Stefan Wahren <wahrenst@gmx.net>

Previous attempts at fixing this:

https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/

including a patch from William from nearly 18 months ago, which was not 
captured by lore however.

Is anyone collecting patches for that platform still?
Stefan Wahren Dec. 24, 2023, 11:17 a.m. UTC | #2
Hi Florian,

Am 24.12.23 um 11:12 schrieb Florian Fainelli:
>
>
> On 12/23/2023 1:35 PM, Stefan Wahren wrote:
>> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
>> with enabled CONFIG_UBSAN triggers the following warning:
>>
>>   UBSAN: array-index-out-of-bounds in
>> arch/arm/mach-sunxi/mc_smp.c:810:29
>>   index 2 is out of range for type 'sunxi_mc_smp_data [2]'
>>   CPU: 0 PID: 1 Comm: swapper/0 Not tainted
>> 6.7.0-rc6-00248-g5254c0cbc92d
>>   Hardware name: BCM2835
>>    unwind_backtrace from show_stack+0x10/0x14
>>    show_stack from dump_stack_lvl+0x40/0x4c
>>    dump_stack_lvl from ubsan_epilogue+0x8/0x34
>>    ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
>>    __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
>>    sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
>>    do_one_initcall from kernel_init_freeable+0xf4/0x2f4
>>    kernel_init_freeable from kernel_init+0x18/0x158
>>    kernel_init from ret_from_fork+0x14/0x28
>>
>> Since the enabled method couldn't match with any entry from
>> sunxi_mc_smp_data, the value of the index shouldn't be used right after
>> the loop. So move it after the check of ret in order to have a valid
>> index.
>>
>> Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
>> Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
>
> Previous attempts at fixing this:
>
> https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
thanks for pointing out. Nick's version missed the refcounting of node
and my version missed the proper handling of of_property_match_string.
So we have actually two issues in the original code.

I will prepare a second version.

Nevertheless merry x-mas
>
> including a patch from William from nearly 18 months ago, which was
> not captured by lore however.
>
> Is anyone collecting patches for that platform still?
diff mbox series

Patch

diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index cb63921232a6..6ec3445f3c72 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -807,12 +807,12 @@  static int __init sunxi_mc_smp_init(void)
 			break;
 	}

-	is_a83t = sunxi_mc_smp_data[i].is_a83t;
-
 	of_node_put(node);
 	if (ret)
 		return -ENODEV;

+	is_a83t = sunxi_mc_smp_data[i].is_a83t;
+
 	if (!sunxi_mc_smp_cpu_table_init())
 		return -EINVAL;