| Message ID | 20231223123546.88125-1-wahrenst@gmx.net (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init | expand |
On 12/23/2023 1:35 PM, Stefan Wahren wrote: > Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+ > with enabled CONFIG_UBSAN triggers the following warning: > > UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29 > index 2 is out of range for type 'sunxi_mc_smp_data [2]' > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d > Hardware name: BCM2835 > unwind_backtrace from show_stack+0x10/0x14 > show_stack from dump_stack_lvl+0x40/0x4c > dump_stack_lvl from ubsan_epilogue+0x8/0x34 > ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80 > __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc > sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc > do_one_initcall from kernel_init_freeable+0xf4/0x2f4 > kernel_init_freeable from kernel_init+0x18/0x158 > kernel_init from ret_from_fork+0x14/0x28 > > Since the enabled method couldn't match with any entry from > sunxi_mc_smp_data, the value of the index shouldn't be used right after > the loop. So move it after the check of ret in order to have a valid > index. > > Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field") > Signed-off-by: Stefan Wahren <wahrenst@gmx.net> Previous attempts at fixing this: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ including a patch from William from nearly 18 months ago, which was not captured by lore however. Is anyone collecting patches for that platform still?
Hi Florian, Am 24.12.23 um 11:12 schrieb Florian Fainelli: > > > On 12/23/2023 1:35 PM, Stefan Wahren wrote: >> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+ >> with enabled CONFIG_UBSAN triggers the following warning: >> >> UBSAN: array-index-out-of-bounds in >> arch/arm/mach-sunxi/mc_smp.c:810:29 >> index 2 is out of range for type 'sunxi_mc_smp_data [2]' >> CPU: 0 PID: 1 Comm: swapper/0 Not tainted >> 6.7.0-rc6-00248-g5254c0cbc92d >> Hardware name: BCM2835 >> unwind_backtrace from show_stack+0x10/0x14 >> show_stack from dump_stack_lvl+0x40/0x4c >> dump_stack_lvl from ubsan_epilogue+0x8/0x34 >> ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80 >> __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc >> sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc >> do_one_initcall from kernel_init_freeable+0xf4/0x2f4 >> kernel_init_freeable from kernel_init+0x18/0x158 >> kernel_init from ret_from_fork+0x14/0x28 >> >> Since the enabled method couldn't match with any entry from >> sunxi_mc_smp_data, the value of the index shouldn't be used right after >> the loop. So move it after the check of ret in order to have a valid >> index. >> >> Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field") >> Signed-off-by: Stefan Wahren <wahrenst@gmx.net> > > Previous attempts at fixing this: > > https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ thanks for pointing out. Nick's version missed the refcounting of node and my version missed the proper handling of of_property_match_string. So we have actually two issues in the original code. I will prepare a second version. Nevertheless merry x-mas > > including a patch from William from nearly 18 months ago, which was > not captured by lore however. > > Is anyone collecting patches for that platform still?
diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c index cb63921232a6..6ec3445f3c72 100644 --- a/arch/arm/mach-sunxi/mc_smp.c +++ b/arch/arm/mach-sunxi/mc_smp.c @@ -807,12 +807,12 @@ static int __init sunxi_mc_smp_init(void) break; } - is_a83t = sunxi_mc_smp_data[i].is_a83t; - of_node_put(node); if (ret) return -ENODEV; + is_a83t = sunxi_mc_smp_data[i].is_a83t; + if (!sunxi_mc_smp_cpu_table_init()) return -EINVAL;
Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+ with enabled CONFIG_UBSAN triggers the following warning: UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29 index 2 is out of range for type 'sunxi_mc_smp_data [2]' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d Hardware name: BCM2835 unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x40/0x4c dump_stack_lvl from ubsan_epilogue+0x8/0x34 ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80 __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc do_one_initcall from kernel_init_freeable+0xf4/0x2f4 kernel_init_freeable from kernel_init+0x18/0x158 kernel_init from ret_from_fork+0x14/0x28 Since the enabled method couldn't match with any entry from sunxi_mc_smp_data, the value of the index shouldn't be used right after the loop. So move it after the check of ret in order to have a valid index. Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field") Signed-off-by: Stefan Wahren <wahrenst@gmx.net> --- arch/arm/mach-sunxi/mc_smp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1