CVE-2021-32078 (Other, published 2021-06-17T15:15Z)
Description: value: An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/torvalds/linux
Files changed:
arch/arm/configs/footbridge_defconfig
arch/arm/mach-footbridge/Kconfig
arch/arm/mach-footbridge/Makefile
Commit message: ARM: footbridge: remove personal server platform

Remove the personal server platform, as that has had an array overrun
issue identified. It is believed that no one is using this code.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>


Vulnerable code:
CONFIG_ARCH_PERSONAL_SERVER=y
config ARCH_PERSONAL_SERVER
	bool "Compaq Personal Server"
	select FOOTBRIDGE_HOST
	select ISA
	select ISA_DMA
	select FORCE_PCI
	help
	  Say Y here if you intend to run this kernel on the Compaq
	  Personal Server.

	  Saying N will reduce the size of the Footbridge kernel.

	  The Compaq Personal Server is not available for purchase.
	  There are no product plans beyond the current research
	  prototypes at this time.  Information is available at:

	  <http://www.crl.hpl.hp.com/projects/personalserver/>

	  If you have any questions or comments about the  Compaq Personal
	  Server, send e-mail to <skiff@crl.dec.com>.

pci-$(CONFIG_ARCH_PERSONAL_SERVER) += personal-pci.o
obj-$(CONFIG_ARCH_PERSONAL_SERVER) += personal.o dc21285-timer.o
// SPDX-License-Identifier: GPL-2.0
/*
 * linux/arch/arm/mach-footbridge/personal-pci.c
 *
 * PCI bios-type initialisation for PCI machines
 *
 * Bits taken from various places.
 */
#include <linux/kernel.h>
#include <linux/pci.h>
#include <linux/init.h>

#include <asm/irq.h>
#include <asm/mach/pci.h>
#include <asm/mach-types.h>

static int irqmap_personal_server[] __initdata = {
	IRQ_IN0, IRQ_IN1, IRQ_IN2, IRQ_IN3, 0, 0, 0,
	IRQ_DOORBELLHOST, IRQ_DMA1, IRQ_DMA2, IRQ_PCI
};

static int __init personal_server_map_irq(const struct pci_dev *dev, u8 slot,
	u8 pin)
{
	unsigned char line;

	pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &line);

	if (line > 0x40 && line <= 0x5f) {
		/* line corresponds to the bit controlling this interrupt
		 * in the footbridge.  Ignore the first 8 interrupt bits,
		 * look up the rest in the map.  IN0 is bit number 8
		 */
		return irqmap_personal_server[(line & 0x1f) - 8];
	} else if (line == 0) {
		/* no interrupt */
		return 0;
	} else
		return irqmap_personal_server[(line - 1) & 3];
}

static struct hw_pci personal_server_pci __initdata = {
	.map_irq		= personal_server_map_irq,
	.nr_controllers		= 1,
	.ops			= &dc21285_ops,
	.setup			= dc21285_setup,
	.preinit		= dc21285_preinit,
	.postinit		= dc21285_postinit,
};

static int __init personal_pci_init(void)
{
	if (machine_is_personal_server())
		pci_common_init(&personal_server_pci);
	return 0;
}

subsys_initcall(personal_pci_init);
// SPDX-License-Identifier: GPL-2.0
/*
 * linux/arch/arm/mach-footbridge/personal.c
 *
 * Personal server (Skiff) machine fixup
 */
#include <linux/init.h>
#include <linux/spinlock.h>

#include <asm/hardware/dec21285.h>
#include <asm/mach-types.h>

#include <asm/mach/arch.h>

#include "common.h"

MACHINE_START(PERSONAL_SERVER, "Compaq-PersonalServer")
	/* Maintainer: Jamey Hicks / George France */
	.atag_offset	= 0x100,
	.map_io		= footbridge_map_io,
	.init_irq	= footbridge_init_irq,
	.init_time	= footbridge_timer_init,
	.restart	= footbridge_restart,
MACHINE_END


Fixed code: