android_kernel_motorola_sm6375/arch
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Stefan Wahren 4c0fa624a6 ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
[ Upstream commit 72ad3b772b6d393701df58ba1359b0bb346a19ed ]

Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+
with enabled CONFIG_UBSAN triggers the following warning:

 UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
 index 2 is out of range for type 'sunxi_mc_smp_data [2]'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d
 Hardware name: BCM2835
  unwind_backtrace from show_stack+0x10/0x14
  show_stack from dump_stack_lvl+0x40/0x4c
  dump_stack_lvl from ubsan_epilogue+0x8/0x34
  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
  __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc
  sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc
  do_one_initcall from kernel_init_freeable+0xf4/0x2f4
  kernel_init_freeable from kernel_init+0x18/0x158
  kernel_init from ret_from_fork+0x14/0x28

Since the enabled method couldn't match with any entry from
sunxi_mc_smp_data, the value of the index shouldn't be used right after
the loop. So move it after the check of ret in order to have a valid
index.

Fixes: 1631090e34 ("ARM: sun9i: smp: Add is_a83t field")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231228193903.9078-1-wahrenst@gmx.net
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-15 18:25:26 +01:00
..
alpha alpha: remove __init annotation from exported page_is_ram() 2023-08-16 18:19:25 +02:00
arc ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard 2023-07-27 08:37:18 +02:00
arm ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init 2024-01-15 18:25:26 +01:00
arm64 arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify 2023-12-20 15:41:24 +01:00
c6x
csky
h8300
hexagon
ia64 ia64/cpu: Switch to arch_cpu_finalize_init() 2023-08-08 19:56:34 +02:00
m68k m68k: Fix invalid .section syntax 2023-09-23 10:59:38 +02:00
microblaze
mips MIPS: KVM: Fix a build warning about variable set but not used 2023-12-08 08:44:24 +01:00
nds32
nios2
openrisc
parisc parisc/pgtable: Do not drop upper 5 address bits of physical address 2023-11-28 16:50:20 +00:00
powerpc powerpc/ftrace: Fix stack teardown in ftrace_no_trace 2023-12-20 15:41:26 +01:00
riscv
s390 s390/vx: fix save/restore of fpu kernel context 2024-01-08 11:29:43 +01:00
sh sh: bios: Revive earlyprintk support 2023-11-20 10:30:13 +01:00
sparc sparc/cpu: Switch to arch_cpu_finalize_init() 2023-08-08 19:56:34 +02:00
um um: Fix hostaudio build errors 2023-09-23 10:59:53 +02:00
unicore32
x86 x86/alternatives: Sync core before enabling interrupts 2024-01-08 11:29:47 +01:00
xtensa xtensa: boot/lib: fix function prototypes 2023-10-10 21:46:39 +02:00
.gitignore
Kconfig init: Provide arch_cpu_finalize_init() 2023-08-08 19:56:33 +02:00