From patchwork Thu Jul 29 13:54:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 488727 Delivered-To: patch@linaro.org Received: by 2002:a05:6638:1185:0:0:0:0 with SMTP id f5csp2187283jas; Thu, 29 Jul 2021 06:59:29 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyQwP/wh8mnq1ecn/kMF9I2OICs1J4esVJE4jrYA4NUj5r9zl50uClRSEDZtWBZEXfBKM69 X-Received: by 2002:a05:6e02:1c0b:: with SMTP id l11mr3864472ilh.126.1627567169586; Thu, 29 Jul 2021 06:59:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1627567169; cv=none; d=google.com; s=arc-20160816; b=rymKeGtNmrEBecQogNieEydiSMQSilzRdRgoT+KmlVQqD5trYsBpOQ33Fg8L0YJ5z6 3fSvlY3YmixqXFNlyOouRDn81R+ONbbnbBmihvqOoMDV5Vj2vEe1bepgKYCsFuS+2jfN mp1AD3fd6ECQ2jnKSsX8E3rK04kclVQt4TyAUy7iAsILAff5hfszSvNQx9G14jbTSxrA ys3q3v4oG9fbZXJ9I+NwTD8P6I7CkWXI9YOBaH6AMuzOmyGGVrUCwgUdlEzjXXqoVNIP 8OpC4yyGVvGTPYmpWL2jXdT8sJf4X3UETzFajd+o4JUF0mOzhz9yW+w6kHkUY7umYppE bzQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=UI2Yb5+y7D/5qiFskuSqDVkgtU1rQlyQBHXf0/Tq8hA=; b=Uq1nvVi7caIjNkSVzT0V7FJ+/JIyb91Eli7iZ8pEIKuioTjvqsgrjT6O+46lZ7ZBwe pI8cqY0wj2Qx2q+GhOnG8wkQa4F7J/c7oJjnMLB7pRPFAZNfiIbtTbiIqX7mgEK3x80m P9ZJhmIS/FAPUI7aVwm64i3OYCfB1PWZ8SSOyo53ciU70GNo8PXP1VpYgMApwPIHrni2 5IEMMpshdnzcFiuufKoYXhDigOzKSOYR/EfhQi552NqM+vhD5uw3tjR3rQQQa6pLXG7H 13+Xe3KoCkZyK6y/VyCQVS3/84z/sX0kF1n2mw1UFDsr6zD2pC+KG7d1ilTMsnwJNKf7 UvIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=D5HB+L1B; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l14si3747418ilf.126.2021.07.29.06.59.29; Thu, 29 Jul 2021 06:59:29 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=D5HB+L1B; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238207AbhG2N7T (ORCPT + 12 others); Thu, 29 Jul 2021 09:59:19 -0400 Received: from mail.kernel.org ([198.145.29.99]:49234 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238285AbhG2N6S (ORCPT ); Thu, 29 Jul 2021 09:58:18 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C81BD60F6F; Thu, 29 Jul 2021 13:58:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1627567095; bh=oruk/BqRssBIvqF3sA9W+md/ywlIw6OeWGOj+hoG1PY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D5HB+L1Bmnu+6wuu+dI7/OnLAv1E18dfJSmosOXfo2H5IU6CSEv6qxDvCPXpGWeqm x1ov9nt+8BCy7yngXMLmW8f0lEdikdv4QZ1/Ok2pey4Jo46+XbZrgtbjRdX6YTC+eh 3K615TgibC4OoMRdDb2EXBhFuaTTLo/se30VpdlI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Dan Carpenter , Cristian Marussi , Sudeep Holla , Sasha Levin Subject: [PATCH 5.10 18/24] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Date: Thu, 29 Jul 2021 15:54:38 +0200 Message-Id: <20210729135137.834179056@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210729135137.267680390@linuxfoundation.org> References: <20210729135137.267680390@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sudeep Holla [ Upstream commit 7a691f16ccad05d770f813d9c4b4337a30c6d63f ] The scmi_linux_errmap buffer access index is supposed to depend on the array size to prevent element out of bounds access. It uses SCMI_ERR_MAX to check bounds but that can mismatch with the array size. It also changes the success into -EIO though scmi_linux_errmap is never used in case of success, it is expected to work for success case too. It is slightly confusing code as the negative of the error code is used as index to the buffer. Fix it by negating it at the start and make it more readable. Link: https://lore.kernel.org/r/20210707135028.1869642-1-sudeep.holla@arm.com Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/driver.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index af4560dab6b4..6fa024d1dd99 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -43,7 +43,6 @@ enum scmi_error_codes { SCMI_ERR_GENERIC = -8, /* Generic Error */ SCMI_ERR_HARDWARE = -9, /* Hardware Error */ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */ - SCMI_ERR_MAX }; /* List of all SCMI devices active in system */ @@ -118,8 +117,10 @@ static const int scmi_linux_errmap[] = { static inline int scmi_to_linux_errno(int errno) { - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) - return scmi_linux_errmap[-errno]; + int err_idx = -errno; + + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) + return scmi_linux_errmap[err_idx]; return -EIO; }