linux-kernel - Re: [PATCH] ARM: sunxi: fix return code check of of_property_match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKwvOdngn_v3oW4iTFZ1rBKOtWNUAk_-qc+u3V+UhM5wmwzSdg@mail.gmail.com>
Date:   Mon, 22 May 2023 12:55:30 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     "William (Zhenghao) Zhang" <william.zhang@...adcom.com>
Cc:     Chen-Yu Tsai <wens@...e.org>,
        Jernej Skrabec <jernej.skrabec@...il.com>,
        Samuel Holland <samuel@...lland.org>,
        Russell King <linux@...linux.org.uk>,
        Arnd Bergmann <arnd@...db.de>,
        linux-arm-kernel@...ts.infradead.org, linux-sunxi@...ts.linux.dev,
        linux-kernel@...r.kernel.org,
        Florian Fainelli <f.fainelli@...il.com>
Subject: Re: [PATCH] ARM: sunxi: fix return code check of of_property_match_string

On Tue, May 16, 2023 at 11:34 AM Florian Fainelli <f.fainelli@...il.com> wrote:
>
> +William,
>
> On 5/16/23 09:35, ndesaulniers@...gle.com wrote:
> > of_property_match_string returns an int; either an index from 0 or
> > greater if successful or negative on failure.
> >
> > Fixes the following splat observed with UBSAN:
> > [    0.166489][    T1] UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29
> > [    0.166934][    T1] index 2 is out of range for type 'sunxi_mc_smp_data [2]'
> > [    0.167206][    T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W          6.4.0-rc2 #1
> > [    0.167515][    T1] Hardware name: Generic DT based system
> > [    0.167727][    T1]  unwind_backtrace from show_stack+0x18/0x1c
> > [    0.167979][    T1]  show_stack from dump_stack_lvl+0x68/0x90
> > [    0.168226][    T1]  dump_stack_lvl from ubsan_epilogue+0x8/0x34
> > [    0.168474][    T1]  ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80
> > [    0.168760][    T1]  __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe8/0x574
> > [    0.169100][    T1]  sunxi_mc_smp_init from do_one_initcall+0x178/0x9c8
> > [    0.169364][    T1]  do_one_initcall from kernel_init_freeable+0x1dc/0x28c
> > [    0.169661][    T1]  kernel_init_freeable from kernel_init+0x20/0x164
> > [    0.169912][    T1]  kernel_init from ret_from_fork+0x14/0x2c
> >
> > Signed-off-by: Nick Desaulniers <ndesaulniers@...gle.com>
>
> William had a similar fix submitted back in September of last year, but
> I do not believe it got applied either:
>
> https://lore.kernel.org/r/20220929012944.454613-1-william.zhang@broadcom.com
>
> lore was not able to find it, but above is the message ID, and attached
> is his original patch.

Hi William,
How would you like to proceed here? I don't want to step on any toes
if there's an existing patch.

> --
> Florian



-- 
Thanks,
~Nick Desaulniers