Received-SPF: pass (google.com: domain of bcm-kernel-feedback-list.pdl+bncbdrnrc6tsecrbgpk2omqmgqexzmegjy@broadcom.com designates 2607:f8b0:4864:20::645 as permitted sender) client-ip=2607:f8b0:4864:20::645;
Received-SPF: pass (google.com: domain broadcom.com configured 192.19.166.232 as internal address)
From: William Zhang <william.zhang@broadcom.com>
To: Linux ARM List <linux-arm-kernel@lists.infradead.org>
Cc: f.fainelli@gmail.com,
	anand.gore@broadcom.com,
	Broadcom Kernel List <bcm-kernel-feedback-list@broadcom.com>,
	William Zhang <william.zhang@broadcom.com>,
	Chen-Yu Tsai <wens@csie.org>,
	Jernej Skrabec <jernej.skrabec@gmail.com>,
	Maxime Ripard <mripard@kernel.org>,
	=?UTF-8?q?Myl=C3=A8ne=20Josserand?= <mylene.josserand@bootlin.com>,
	Russell King <linux@armlinux.org.uk>,
	Samuel Holland <samuel@sholland.org>,
	linux-kernel@vger.kernel.org,
	linux-sunxi@lists.linux.dev
Subject: [PATCH] ARM: sun9i: smp: fix out-of-bounds access error
Date: Wed, 28 Sep 2022 18:29:43 -0700
Message-Id: <20220929012944.454613-1-william.zhang@broadcom.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: list
Mailing-list: list bcm-kernel-feedback-list.pdl@broadcom.com; contact bcm-kernel-feedback-list.pdl+owners@broadcom.com

When running multi_v7_defconfig with CONFIG_UBSAN enabled, kernel
reports UBSAN array-index-out-of-bounds error in sunxi_mc_smp_init
function on non-sunxi platform.

Checking index to the sunxi_mc_smp_data array for out-of-bounds
condition is needed to cover non-sunxi platform. Also fix the handling
of return value from of_property_match_string function. Only negitive
value is an error condition and should bail out from the function.

Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")

Signed-off-by: William Zhang <william.zhang@broadcom.com>

---

 arch/arm/mach-sunxi/mc_smp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index 26cbce135338..0373fa002f04 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -804,16 +804,16 @@ static int __init sunxi_mc_smp_init(void)
 	for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) {
 		ret = of_property_match_string(node, "enable-method",
 					       sunxi_mc_smp_data[i].enable_method);
-		if (!ret)
+		if (ret >= 0)
 			break;
 	}
 
-	is_a83t = sunxi_mc_smp_data[i].is_a83t;
-
 	of_node_put(node);
-	if (ret)
+	if (ret < 0 || i >= ARRAY_SIZE(sunxi_mc_smp_data))
 		return -ENODEV;
 
+	is_a83t = sunxi_mc_smp_data[i].is_a83t;
+
 	if (!sunxi_mc_smp_cpu_table_init())
 		return -EINVAL;
 
-- 
2.37.3