linux/drivers/firmware
Arnd Bergmann f3217d6f2f firmware: xilinx: fix out-of-bounds access
The zynqmp_pm_set_suspend_mode() and zynqmp_pm_get_trustzone_version()
functions pass values as api_id into zynqmp_pm_invoke_fn
that are beyond PM_API_MAX, resulting in an out-of-bounds access:

drivers/firmware/xilinx/zynqmp.c: In function 'zynqmp_pm_set_suspend_mode':
drivers/firmware/xilinx/zynqmp.c:150:24: warning: array subscript 2562 is above array bounds of 'u32[64]' {aka 'unsigned int[64]'} [-Warray-bounds]
  150 |  if (zynqmp_pm_features[api_id] != PM_FEATURE_UNCHECKED)
      |      ~~~~~~~~~~~~~~~~~~^~~~~~~~
drivers/firmware/xilinx/zynqmp.c:28:12: note: while referencing 'zynqmp_pm_features'
   28 | static u32 zynqmp_pm_features[PM_API_MAX];
      |            ^~~~~~~~~~~~~~~~~~

Replace the resulting undefined behavior with an error return.
This may break some things that happen to work at the moment
but seems better than randomly overwriting kernel data.

I assume we need additional fixes for the two functions that now
return an error.

Fixes: 76582671eb ("firmware: xilinx: Add Zynqmp firmware driver")
Fixes: e178df31cf ("firmware: xilinx: Implement ZynqMP power management APIs")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026155449.3703142-1-arnd@kernel.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-09 18:35:35 +01:00
..
arm_scmi firmware: arm_scmi: Fix duplicate workqueue name 2020-10-14 18:42:41 +01:00
broadcom firmware: bcm47xx_sprom: Fix -Wmissing-prototypes warnings 2020-08-17 13:47:28 +02:00
efi RISC-V Patches for the 5.10 Merge Window, Part 1 2020-10-19 18:18:30 -07:00
google efi: gsmi: fix false dependency on CONFIG_EFI_VARS 2020-09-29 19:40:57 +02:00
imx firmware: imx: scu-pd: ignore power domain not owned 2020-09-13 09:45:53 +08:00
meson firmware: meson_sm: Add secure power domain support 2020-02-14 11:37:34 -08:00
psci firmware: psci: Extend psci_set_osi_mode() to allow reset to PC mode 2020-09-22 17:50:32 +02:00
smccc firmware: smccc: Export both smccc functions 2020-09-14 07:30:36 +01:00
tegra firmware: tegra: Enable BPMP support on Tegra234 2020-09-18 15:57:04 +02:00
xilinx firmware: xilinx: fix out-of-bounds access 2020-11-09 18:35:35 +01:00
arm_scpi.c firmware: arm_scpi: Replace zero-length array with flexible-array member 2020-02-20 17:13:59 +00:00
arm_sdei.c firmware: arm_sdei: Remove _sdei_event_unregister() 2020-09-28 21:52:23 +01:00
dmi_scan.c Replace HTTP links with HTTPS ones: DMI/SMBIOS SUPPORT 2020-07-16 11:46:24 +02:00
dmi-id.c firmware/dmi: Report DMI Bios & EC firmware release 2020-06-06 11:35:50 +02:00
dmi-sysfs.c firmware: dmi-sysfs: Replace zero-length array with flexible-array member 2020-06-15 23:08:04 -05:00
edd.c edd: Use scnprintf() for avoiding potential buffer overflow 2020-04-02 20:42:29 +02:00
iscsi_ibft_find.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 287 2019-06-05 17:36:37 +02:00
iscsi_ibft.c ibft: Replace zero-length array with flexible-array 2020-06-15 23:08:31 -05:00
Kconfig ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
Makefile firmware: arm_scmi: Enable building as a single module 2020-09-14 07:31:03 +01:00
memmap.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 287 2019-06-05 17:36:37 +02:00
pcdp.c efi/ia64: Move HCDP and MPS table handling into IA64 arch code 2020-02-23 21:59:42 +01:00
pcdp.h firmware: pcdp: Replace zero-length array with flexible-array 2020-06-15 23:08:32 -05:00
qcom_scm-legacy.c firmware: qcom_scm-legacy: Replace zero-length array with flexible-array 2020-05-12 15:16:33 -07:00
qcom_scm-smc.c firmware: qcom_scm: Dynamically support SMCCC and legacy conventions 2020-01-07 22:14:43 -08:00
qcom_scm.c media: firmware: qcom_scm: Add memory protect virtual address ranges 2020-09-14 15:45:25 +02:00
qcom_scm.h media: firmware: qcom_scm: Add memory protect virtual address ranges 2020-09-14 15:45:25 +02:00
qemu_fw_cfg.c fw_cfg: Add support for parisc architecture 2020-10-15 08:10:37 +02:00
raspberrypi.c Revert "firmware: raspberrypi: Introduce vl805 init routine" 2020-08-18 13:01:11 +02:00
scpi_pm_domain.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201 2019-05-30 11:29:52 -07:00
stratix10-rsu.c firmware: stratix10-rsu: fix warnings 2020-07-02 14:48:48 +02:00
stratix10-svc.c firmware: stratix10-svc: extend svc to support new RSU features 2020-07-02 14:48:48 +02:00
ti_sci.c ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
ti_sci.h firmware: ti_sci: Replace HTTP links with HTTPS ones 2020-07-24 14:44:52 -07:00
trusted_foundations.c firmware: tf: Different way of L2 cache enabling after LP2 suspend 2020-05-06 18:27:26 +02:00
turris-mox-rwtm.c firmware: turris-mox-rwtm: support ECDSA signatures via debugfs 2020-07-18 22:35:01 +02:00