WSL2-Linux-Kernel/arch/arm
Stefan Wahren 5c161f2220 ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
[ Upstream commit 72ad3b772b6d393701df58ba1359b0bb346a19ed ]

Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
with enabled CONFIG_UBSAN triggers the following warning:

 UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
 index 2 is out of range for type 'sunxi_mc_smp_data [2]'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
 Hardware name: BCM2835
  unwind_backtrace from show_stack+0x10/0x14
  show_stack from dump_stack_lvl+0x40/0x4c
  dump_stack_lvl from ubsan_epilogue+0x8/0x34
  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
  __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
  sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
  do_one_initcall from kernel_init_freeable+0xf4/0x2f4
  kernel_init_freeable from kernel_init+0x18/0x158
  kernel_init from ret_from_fork+0x14/0x28

Since the enabled method couldn't match with any entry from
sunxi_mc_smp_data, the value of the index shouldn't be used right after
the loop. So move it after the check of ret in order to have a valid
index.

Fixes: 1631090e34 ("ARM: sun9i: smp: Add is_a83t field")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231228193903.9078-1-wahrenst@gmx.net
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-15 18:51:14 +01:00
..
boot ARM: dts: Fix occasional boot hang for am3 usb 2024-01-05 15:13:37 +01:00
common
configs ARM: defconfig: drop CONFIG_DRM_RCAR_LVDS 2023-06-09 10:32:35 +02:00
crypto
include ARM: 9320/1: fix stack depot IRQ stack filter 2023-11-28 16:56:18 +00:00
kernel ARM: 9317/1: kexec: Make smp stop calls asynchronous 2023-09-23 11:09:58 +02:00
lib ARM: 9321/1: memset: cast the constant byte to unsigned char 2023-11-20 11:08:23 +01:00
mach-actions
mach-alpine
mach-artpec
mach-asm9260
mach-aspeed
mach-at91
mach-axxia
mach-bcm
mach-berlin
mach-clps711x
mach-cns3xxx
mach-davinci treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-digicolor
mach-dove treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-ep93xx ARM: ep93xx: fix missing-prototype warnings 2023-07-23 13:47:03 +02:00
mach-exynos
mach-footbridge
mach-gemini
mach-highbank
mach-hisi
mach-imx ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init 2023-12-13 18:36:41 +01:00
mach-integrator
mach-iop32x
mach-ixp4xx
mach-keystone
mach-lpc18xx treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-lpc32xx treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-mediatek
mach-meson
mach-milbeaut
mach-mmp
mach-moxart
mach-mstar
mach-mv78xx0 treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-mvebu treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-mxs
mach-nomadik
mach-npcm
mach-nspire
mach-omap1 treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-omap2 ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init 2024-01-05 15:13:27 +01:00
mach-orion5x treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-oxnas
mach-pxa treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-qcom
mach-rda
mach-realtek
mach-realview
mach-rockchip
mach-rpc
mach-s3c
mach-s5pv210
mach-sa1100 ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings 2023-05-24 17:36:41 +01:00
mach-shmobile
mach-socfpga
mach-spear treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
mach-sti
mach-stm32
mach-sunxi ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init 2024-01-15 18:51:14 +01:00
mach-tegra
mach-uniphier
mach-ux500
mach-versatile
mach-vexpress
mach-vt8500
mach-zynq
mm treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 1) 2023-10-06 13:18:12 +02:00
net
nwfpe
plat-omap
plat-orion
plat-pxa
plat-versatile
probes ARM: 9303/1: kprobes: avoid missing-declaration warnings 2023-07-23 13:46:46 +02:00
tools
vdso
vfp
xen arm/xen: fix xen_vcpu_info allocation alignment 2023-12-03 07:31:22 +01:00
Kbuild
Kconfig ARM: cpu: Switch to arch_cpu_finalize_init() 2023-08-08 19:58:30 +02:00
Kconfig-nommu
Kconfig.assembler
Kconfig.debug
Makefile