shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 19:08:57 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: firmware: arm_ffa: Fix a possible ffa_linux_errmap buffer overflow

Browse Source 
The ffa_linux_errmap buffer access index is supposed to range from 0-8
but it ranges from 1-9 instead. It reads one element out of bounds. It
also changes the success into -EINVAL though ffa_to_linux_errno is never
used in case of success, it is expected to work for success case too.

It is slightly confusing code as the negative of the error code
is used as index to the buffer. Fix it by negating it at the start and
make it more readable.

Link: https://lore.kernel.org/r/20210707134739.1869481-1-sudeep.holla@arm.com
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit dd925db6f0)
Change-Id: Ib2d05bdee7c79746c8a397e1c67f4ebcdf6c8ad0
Bug: 168585974
Signed-off-by: Will Deacon <willdeacon@google.com>
This commit is contained in:
Sudeep Holla
2021-07-07 14:47:39 +01:00
committed by Will Deacon
parent 9d5cb0b184
commit 5edbcab5d6
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/firmware/arm_ffa/driver.c
View File

@@ -149,8 +149,10 @@ static const int ffa_linux_errmap[] = {
static inline int ffa_to_linux_errno(int errno)
{
if (errno < FFA_RET_SUCCESS && errno >= -ARRAY_SIZE(ffa_linux_errmap))
return ffa_linux_errmap[-errno];
int err_idx = -errno;
if (err_idx >= 0 && err_idx < ARRAY_SIZE(ffa_linux_errmap))
return ffa_linux_errmap[err_idx];
return -EINVAL;
}