| Message ID | 20240618144344.16943-1-amishin@t-argos.ru |
|---|---|
| State | New |
| Headers | show |
| Series | gpio: davinci: Validate the obtained number of IRQs | expand |
On Tue, Jun 18, 2024 at 4:45 PM Aleksandr Mishin <amishin@t-argos.ru> wrote: > > Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken > DT due to any error this value can be any. Without this value validation > there can be out of chips->irqs array boundaries access in > davinci_gpio_probe(). > > Validate the obtained nirq value so that it won't exceed the maximum > number of IRQs per bank. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > Why not Reported-by: ? Bart > Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") > Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> > --- > drivers/gpio/gpio-davinci.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c > index bb499e362912..1d0175d6350b 100644 > --- a/drivers/gpio/gpio-davinci.c > +++ b/drivers/gpio/gpio-davinci.c > @@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) > else > nirq = DIV_ROUND_UP(ngpio, 16); > > + if (nirq > MAX_INT_PER_BANK) { > + dev_err(dev, "Too many IRQs!\n"); > + return -EINVAL; > + } > + > chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); > if (!chips) > return -ENOMEM; > -- > 2.30.2 >
On 21.06.2024 16:59, Bartosz Golaszewski wrote: > On Tue, Jun 18, 2024 at 4:45 PM Aleksandr Mishin <amishin@t-argos.ru> wrote: >> >> Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken >> DT due to any error this value can be any. Without this value validation >> there can be out of chips->irqs array boundaries access in >> davinci_gpio_probe(). >> >> Validate the obtained nirq value so that it won't exceed the maximum >> number of IRQs per bank. >> >> Found by Linux Verification Center (linuxtesting.org) with SVACE. >> > > Why not Reported-by: ? It is an established practice for our project, you can find 700+ applied patches with similar line: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=grep&q=linuxtesting.org > > Bart > >> Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") >> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> >> --- >> drivers/gpio/gpio-davinci.c | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c >> index bb499e362912..1d0175d6350b 100644 >> --- a/drivers/gpio/gpio-davinci.c >> +++ b/drivers/gpio/gpio-davinci.c >> @@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) >> else >> nirq = DIV_ROUND_UP(ngpio, 16); >> >> + if (nirq > MAX_INT_PER_BANK) { >> + dev_err(dev, "Too many IRQs!\n"); >> + return -EINVAL; >> + } >> + >> chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); >> if (!chips) >> return -ENOMEM; >> -- >> 2.30.2 >>
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c index bb499e362912..1d0175d6350b 100644 --- a/drivers/gpio/gpio-davinci.c +++ b/drivers/gpio/gpio-davinci.c @@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) else nirq = DIV_ROUND_UP(ngpio, 16); + if (nirq > MAX_INT_PER_BANK) { + dev_err(dev, "Too many IRQs!\n"); + return -EINVAL; + } + chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); if (!chips) return -ENOMEM;
Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davinci_gpio_probe(). Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> --- drivers/gpio/gpio-davinci.c | 5 +++++ 1 file changed, 5 insertions(+)