Subject: [PATCH] ARM: sun9i: smp: fix out-of-bounds access error
From: William Zhang <[email-masked]>
To: Linux ARM List <[email-masked]>
Cc: [email-masked], [email-masked], Broadcom Kernel List <[email-masked]>, William Zhang <[email-masked]>, Chen-Yu Tsai <[email-masked]>, Jernej Skrabec <[email-masked]>, Maxime Ripard <[email-masked]>,Mylène Josserand <[email-masked]>, Russell King <[email-masked]>, Samuel Holland <[email-masked]>, [email-masked], [email-masked]
Date: Wed, 28 Sep 2022 18:29:43 -0700
List-Id: <bcm-kernel-feedback-list.pdl.broadcom.com>

When running multi_v7_defconfig with CONFIG_UBSAN enabled, kernel
reports UBSAN array-index-out-of-bounds error in sunxi_mc_smp_init
function on non-sunxi platform.

Checking index to the sunxi_mc_smp_data array for out-of-bounds
condition is needed to cover non-sunxi platform. Also fix the handling
of return value from of_property_match_string function. Only negitive
value is an error condition and should bail out from the function.

Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field")

Signed-off-by: William Zhang <[email-masked]>

---

 arch/arm/mach-sunxi/mc_smp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index 26cbce135338..0373fa002f04 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -804,16 +804,16 @@ static int __init sunxi_mc_smp_init(void)
 	for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) {
 		ret = of_property_match_string(node, "enable-method",
 					       sunxi_mc_smp_data[i].enable_method);
-		if (!ret)
+		if (ret >= 0)
 			break;
 	}
 
-	is_a83t = sunxi_mc_smp_data[i].is_a83t;
-
 	of_node_put(node);
-	if (ret)
+	if (ret < 0 || i >= ARRAY_SIZE(sunxi_mc_smp_data))
 		return -ENODEV;
 
+	is_a83t = sunxi_mc_smp_data[i].is_a83t;
+
 	if (!sunxi_mc_smp_cpu_table_init())
 		return -EINVAL;
 
-- 
2.37.3