From patchwork Thu Jul 29 13:54:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 488729 Delivered-To: patch@linaro.org Received: by 2002:a05:6638:1185:0:0:0:0 with SMTP id f5csp2188855jas; Thu, 29 Jul 2021 07:01:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzIcaE5GMTBiv4KQGJk/kxb/zPlAMyGdLSiiKztdVSnlDnem7c7sHPZggz1C6SPDpiYpdp7 X-Received: by 2002:a92:cb06:: with SMTP id s6mr3904160ilo.87.1627567277631; Thu, 29 Jul 2021 07:01:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1627567277; cv=none; d=google.com; s=arc-20160816; b=ZBOZcbCCJf6UL6QfNUv+kwxnSCc6L9g5WEqkhw08xxhrzEbhnkRAXnKM3DFSQ8axct GGp1a7X1cNVMFW1/QrOxTqDhb+hdFMv1erp1kKQ+K+juTisCIp99oGIeyHiCPfbF/xkj xCwqPodAbFGgdGchVV9Ksz7bAN5rEfPYoCzeaL7+P1L6lKDIpzeEobTFVMiJEivwNvm5 SVZ3bmD/D66tiISdhaZT5Cqy+aDH2mfV2iJ3qs7XcGF9nh/vphSabX34WQNJjo/Y+DNH u6sPDh2plHm7kMC02DfcfOubEUPfJQ9ZLKXrghj7DuEEs7/EX8gWXGBWxK6Tlr0g6IbI bm2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=q3ctt2zzkyiyS0219w/4uoFcPpw/cDxh2t0pr+PXKoY=; b=wmiKirCguH/cVfZdS96D0PSnQVwYAbLoJYmPwzTd8Wb2FkTMnaymJQA/TyEH0b3F2A GpIog8/r+iJ+7uFlapJrQdJu8TAFo5OkNOeliLmucAXS5naHcRDpDi2EaDOB2dQw5vSq QIycy0TUAKu6mIY39ChggJ6NizcZUB8JT1I14ez3CRzJ5trC3uLiygxPk0fTI7V+0f1b UcD2FLE5m4mXn/2x0muYDRixPqQXERd6WxFgVCMG+86yNO7w5eTgewHlJQaTqYb5Ry6S GQJoJTu9HsrLuotfIkJ67B58avOyFQ4IwnYvRMA483ewnIC218b9zzowjQVkN/y1XDdA a7VQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=bpW0LYX2; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id q18si3496061jao.21.2021.07.29.07.01.17; Thu, 29 Jul 2021 07:01:17 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=bpW0LYX2; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238052AbhG2OBO (ORCPT + 12 others); Thu, 29 Jul 2021 10:01:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:49422 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238558AbhG2N7Q (ORCPT ); Thu, 29 Jul 2021 09:59:16 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id DAE2061052; Thu, 29 Jul 2021 13:59:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1627567151; bh=XOnHq33KEr7BZjl/ew9RZQkNJP4/vtPq5B3kqmwlO/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bpW0LYX2sgTTWHQRB4K9vXhheyFEbdF3sZQV0WSaWvcqnvrOYDW5slKIgy8mgCnSL QNR0wpnjfn4/tTFrjENLPw/oz5IXuMdHn0o3SMLb/pP2kRcwIfg6k5SAxSp1Og9fDR I05IryXjGVkjTmXNHf/APO03WwjTtF0mzQDIZsXM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Dan Carpenter , Cristian Marussi , Sudeep Holla , Sasha Levin Subject: [PATCH 5.13 16/22] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Date: Thu, 29 Jul 2021 15:54:47 +0200 Message-Id: <20210729135137.847496226@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210729135137.336097792@linuxfoundation.org> References: <20210729135137.336097792@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sudeep Holla [ Upstream commit 7a691f16ccad05d770f813d9c4b4337a30c6d63f ] The scmi_linux_errmap buffer access index is supposed to depend on the array size to prevent element out of bounds access. It uses SCMI_ERR_MAX to check bounds but that can mismatch with the array size. It also changes the success into -EIO though scmi_linux_errmap is never used in case of success, it is expected to work for success case too. It is slightly confusing code as the negative of the error code is used as index to the buffer. Fix it by negating it at the start and make it more readable. Link: https://lore.kernel.org/r/20210707135028.1869642-1-sudeep.holla@arm.com Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/driver.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 74986bf96656..6bff4cceb3c3 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -47,7 +47,6 @@ enum scmi_error_codes { SCMI_ERR_GENERIC = -8, /* Generic Error */ SCMI_ERR_HARDWARE = -9, /* Hardware Error */ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */ - SCMI_ERR_MAX }; /* List of all SCMI devices active in system */ @@ -166,8 +165,10 @@ static const int scmi_linux_errmap[] = { static inline int scmi_to_linux_errno(int errno) { - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) - return scmi_linux_errmap[-errno]; + int err_idx = -errno; + + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) + return scmi_linux_errmap[err_idx]; return -EIO; }