[linux-next:master 4170/14098] drivers/firmware/arm_ffa/driver.c:148 ffa_to_linux_errno() error: buffer overflow 'ffa_linux_errmap' 9 <= 9

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head:   fb0ca446157a86b75502c1636b0d81e642fe6bf1
commit: 3bbfe9871005f38df2955b2e125933edf1d2feef [4170/14098] firmware: arm_ffa: Add initial Arm FFA driver support
config: arm64-randconfig-m031-20210702 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <redacted>
Reported-by: Dan Carpenter <redacted>

smatch warnings:
drivers/firmware/arm_ffa/driver.c:148 ffa_to_linux_errno() error: buffer overflow 'ffa_linux_errmap' 9 <= 9

vim +/ffa_linux_errmap +148 drivers/firmware/arm_ffa/driver.c

3bbfe9871005f3 Sudeep Holla 2021-05-21  144  
3bbfe9871005f3 Sudeep Holla 2021-05-21  145  static inline int ffa_to_linux_errno(int errno)
3bbfe9871005f3 Sudeep Holla 2021-05-21  146  {
3bbfe9871005f3 Sudeep Holla 2021-05-21  147  	if (errno < FFA_RET_SUCCESS && errno >= -ARRAY_SIZE(ffa_linux_errmap))
3bbfe9871005f3 Sudeep Holla 2021-05-21 @148  		return ffa_linux_errmap[-errno];
3bbfe9871005f3 Sudeep Holla 2021-05-21  149  	return -EINVAL;

Smatch is correct.  This is supposed to go from 0-8 but it goes from
1-9.  This code changes success into -EINVAL and reads one element out
of bounds.  It's slightly confusing code.  Better to do the negate at
the start.

	errno = -errno;

	if (errno >= 0 && errno < ARRAY_SIZE(ffa_linux_errmap))
		return ffa_linux_errmap[errno];

	return -EINVAL;

Or idx = -errno; would probably be even better...

3bbfe9871005f3 Sudeep Holla 2021-05-21  150  }
3bbfe9871005f3 Sudeep Holla 2021-05-21  151  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org