linux-kernel - [PATCH 2/2] firmware: arm_scmi: Fix pointers arithmetic in Base protocol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220530115237.277077-2-cristian.marussi@arm.com>
Date:   Mon, 30 May 2022 12:52:37 +0100
From:   Cristian Marussi <cristian.marussi@....com>
To:     linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Cc:     Cristian Marussi <cristian.marussi@....com>,
        Sudeep Holla <sudeep.holla@....com>
Subject: [PATCH 2/2] firmware: arm_scmi: Fix pointers arithmetic in Base protocol

Fix a possible undefined behaviour involving pointer arithmetic in Base
protocol scmi_base_implementation_list_get().

cppcheck complains with:

drivers/firmware/arm_scmi/base.c:190:19: warning: 't->rx.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [arithOperationsOnVoidPointer]
 list = t->rx.buf + sizeof(*num_ret);

Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol")
Cc: Sudeep Holla <sudeep.holla@....com>
Signed-off-by: Cristian Marussi <cristian.marussi@....com>
---
 drivers/firmware/arm_scmi/base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
index 20fba7370f4e..6d6214d9e68c 100644
--- a/drivers/firmware/arm_scmi/base.c
+++ b/drivers/firmware/arm_scmi/base.c
@@ -187,7 +187,7 @@ scmi_base_implementation_list_get(const struct scmi_protocol_handle *ph,
 
 	num_skip = t->tx.buf;
 	num_ret = t->rx.buf;
-	list = t->rx.buf + sizeof(*num_ret);
+	list = ((u8 *)t->rx.buf) + sizeof(*num_ret);
 
 	do {
 		size_t real_list_sz;
-- 
2.32.0