linux-kernel - Re: [PATCH] ARM: fix out-of-bound access to ipi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <86imwezupb.wl-marc.zyngier@arm.com>
Date:   Tue, 19 Mar 2019 16:37:36 +0000
From:   Marc Zyngier <marc.zyngier@....com>
To:     Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     linux-arm-kernel@...ts.infradead.org,
        Russell King <rmk+kernel@...linux.org.uk>,
        Grygorii Strashko <grygorii.strashko@...com>,
        linux-kernel@...r.kernel.org, Yufen Wang <wangyufen@...wei.com>,
        Russell King <linux@...linux.org.uk>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Arnd Bergmann <arnd@...db.de>
Subject: Re: [PATCH] ARM: fix out-of-bound access to ipi_types[]

On Tue, 19 Mar 2019 15:52:25 +0000,
Masahiro Yamada <yamada.masahiro@...ionext.com> wrote:
> 
> Since commit e7273ff49acf ("ARM: 8488/1: Make IPI_CPU_BACKTRACE a
> "non-secure" SGI"), IPI_CPU_BACKTRACE is assigned to SGI7.
> 
> raise_nmi() passes IPI_CPU_BACKTRACE (=7) into smp_cross_call(),
> but it is above the array bound of ipi_types[].
> 
> Increase NR_IPI, and add the entry to ipi_types[].
> 
> This fixes the following GCC warning:
> 
>   CC      arch/arm/kernel/smp.o
> arch/arm/kernel/smp.c: In function 'raise_nmi':
> arch/arm/kernel/smp.c:522:2: warning: array subscript 7 is above array bounds of 'const char *[7]' [-Warray-bounds]
>   trace_ipi_raise_rcuidle(target, ipi_types[ipinr]);
>   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Signed-off-by: Masahiro Yamada <yamada.masahiro@...ionext.com>
> ---

+Arnd.

A fix for this has been around since 2016:

http://lists.infradead.org/pipermail/linux-arm-kernel/2016-February/409393.html

and reposted several times since. I don't know why it hasn't been
picked up.

	M.

-- 
Jazz is not dead, it just smell funny.