[PATCH] ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
Florian Fainelli
f.fainelli at gmail.com
Sun Dec 24 02:12:53 PST 2023
On 12/23/2023 1:35 PM, Stefan Wahren wrote:
> Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
> with enabled CONFIG_UBSAN triggers the following warning:
>
> UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
> index 2 is out of range for type 'sunxi_mc_smp_data [2]'
> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
> Hardware name: BCM2835
> unwind_backtrace from show_stack+0x10/0x14
> show_stack from dump_stack_lvl+0x40/0x4c
> dump_stack_lvl from ubsan_epilogue+0x8/0x34
> ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
> __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
> sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
> do_one_initcall from kernel_init_freeable+0xf4/0x2f4
> kernel_init_freeable from kernel_init+0x18/0x158
> kernel_init from ret_from_fork+0x14/0x28
>
> Since the enabled method couldn't match with any entry from
> sunxi_mc_smp_data, the value of the index shouldn't be used right after
> the loop. So move it after the check of ret in order to have a valid
> index.
>
> Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")
> Signed-off-by: Stefan Wahren <wahrenst at gmx.net>
Previous attempts at fixing this:
https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
including a patch from William from nearly 18 months ago, which was not
captured by lore however.
Is anyone collecting patches for that platform still?
--
Florian
More information about the linux-arm-kernel
mailing list