From patchwork Thu Jul 29 13:54:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 488725 Delivered-To: patch@linaro.org Received: by 2002:a05:6638:1185:0:0:0:0 with SMTP id f5csp2186022jas; Thu, 29 Jul 2021 06:57:34 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzKHiDQyLujt/nMQx3aSN4/x26HqFKii36P/xw6seiuggh170m4zq2kS+FwQk6XjzeZvxg7 X-Received: by 2002:a6b:f813:: with SMTP id o19mr4175803ioh.49.1627567054299; Thu, 29 Jul 2021 06:57:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1627567054; cv=none; d=google.com; s=arc-20160816; b=RfK9qDM4HHiw2fNmAxir8dWpDXzKnojHu9FTgFBxHFTgpzjIcIUe5SjESTssjHDTzF ZseUpHA4w3ENreyWTbRoNEFnrtZdBNffWypUBAfvk7ZqvdMUGQLJmZRClBN4WuyuHMyu ns1RAU6dnwfuoIQMKSbA5v+KWY19i5mn5GlPWIGqWk7ekwxrqOdhW8gv7Ox5qhCY07Ur 4b4bDNqtHDuvfmTlH/YEofdTljaLNDRmOJzCS/Fz1zbvz6d1/HmJyCMS+O8HzTqAcbHk 3fYDIv0xRF9g3BfnR854FB8aEsIy/iF0Lqn2mUSumEltVk9JbVjPGGg1/8a7Aat4eZbQ pPGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=GX4actOBxOEo/ze+e0nsGMPN/Tft6UW4fFzaKjlqXdY=; b=Hgb/4IWyuxSCNMrWhvcbXVVF2h9UbCvpPG3mUI5crTi6yf25plinwbNGs9hl96CGSZ PRLV/zybzuOXqLRO8UfXyyAYqXcsQAf1PQenujDPcYV08S6hwBFW5UFjuqxgCGa4jTea v584pos0r7Zd/NgerWIju7m/6SL9I2nd1sfzS1e05kjygTVH9yade0XS0KeW6s2xluSF b/0YarehR2fTvnK0JH5+ClSDhYYfL7W6g1MwNXsS9vHONHEKUJ+STBUaWuZbY15R3wiw ERbj9r1clPi4bsl9W/gJ89G+GYoHdrzQf/TXSyYgWhmAgkd3KeBLoCOtUl16fNOoDnZY wodg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=ScMQBNhq; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y1si3319366jap.90.2021.07.29.06.57.34; Thu, 29 Jul 2021 06:57:34 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=ScMQBNhq; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238219AbhG2N5f (ORCPT + 12 others); Thu, 29 Jul 2021 09:57:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:47220 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238184AbhG2N5S (ORCPT ); Thu, 29 Jul 2021 09:57:18 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id A73D960FED; Thu, 29 Jul 2021 13:57:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1627567034; bh=BfeaPjbltn4piMZhsG3NqOM8tGJfuikps89RsPYWgNA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ScMQBNhqsXcTVseqJyWv4ctctaLqUN+2Y+DGma7+1g36DngRdkCjSLSlvEfl36ACZ FnyYj2c7qaKAwaWxRys5LK+8kiI9UbSqYEQYTzJy2eWzvhFPFZSKFJPRmPViPNrNWl o5uAYoj5g7pH+11SCtZO8W1YPxMdNAya/sFpY1ow= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Dan Carpenter , Cristian Marussi , Sudeep Holla , Sasha Levin Subject: [PATCH 5.4 15/21] firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Date: Thu, 29 Jul 2021 15:54:22 +0200 Message-Id: <20210729135143.396784053@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210729135142.920143237@linuxfoundation.org> References: <20210729135142.920143237@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sudeep Holla [ Upstream commit 7a691f16ccad05d770f813d9c4b4337a30c6d63f ] The scmi_linux_errmap buffer access index is supposed to depend on the array size to prevent element out of bounds access. It uses SCMI_ERR_MAX to check bounds but that can mismatch with the array size. It also changes the success into -EIO though scmi_linux_errmap is never used in case of success, it is expected to work for success case too. It is slightly confusing code as the negative of the error code is used as index to the buffer. Fix it by negating it at the start and make it more readable. Link: https://lore.kernel.org/r/20210707135028.1869642-1-sudeep.holla@arm.com Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/driver.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 7b6903bad408..ba2e18d9e0e4 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -54,7 +54,6 @@ enum scmi_error_codes { SCMI_ERR_GENERIC = -8, /* Generic Error */ SCMI_ERR_HARDWARE = -9, /* Hardware Error */ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */ - SCMI_ERR_MAX }; /* List of all SCMI devices active in system */ @@ -176,8 +175,10 @@ static const int scmi_linux_errmap[] = { static inline int scmi_to_linux_errno(int errno) { - if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX) - return scmi_linux_errmap[-errno]; + int err_idx = -errno; + + if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap)) + return scmi_linux_errmap[err_idx]; return -EIO; }