From patchwork Mon Jun 6 16:27:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Borneo X-Patchwork-Id: 12870658 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0D746C433EF for ; Mon, 6 Jun 2022 16:30:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=As6mJj6tKqpBW81LHHvX1/WMuENJ0ZGFjL6Eheqix+s=; b=ZZRdtyNPAN7gl4 OV96c9SPOjvbrqn5o1085xdsPtfE5fgJIg93d5PUkOimYwxKwpLXvU9kiJp1fnudrpEBVsodeZFiD ipDxYSSssEEszBi3pPT40061mNAr15X/WZXbphnXF4i6GWPcI0HYh23NFfl3vUPRDeJBkcbJS4JP3 sl+WV6T4CHCipXMrPCY+lnslJ5yvczABGfbGM2d6ulEAyQG6Y9Dp+quzPHwhZa8gzxnnToLLafWS8 W3EklCUb+IUxV0WjCv2+EG6x/jnVJJ1XDJ576L297wMjE95JMa+nl3k1feuHhN+h9YuKpcVzEYSrf 6ZTAHrpRPzVBM7yAH3Fg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nyFbe-0022eW-DF; Mon, 06 Jun 2022 16:29:30 +0000 Received: from mx08-00178001.pphosted.com ([91.207.212.93] helo=mx07-00178001.pphosted.com) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nyFbK-0022VZ-5X for linux-arm-kernel@lists.infradead.org; Mon, 06 Jun 2022 16:29:11 +0000 Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 256F1XC5021423; Mon, 6 Jun 2022 18:28:42 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=selector1; bh=MJUdj1zP+sx1j811Eaq4RVk/PwdjBT6XHosmIPCWXnk=; b=Kd9XeKDGmWAFqUhE8ADV3otWFSzM3m3d4da1S7eP7pIaKT1oWnJymLwdq/2KJ7LSgp68 Ipx5mIWhqqhtZuGtLWM4Ikf6Cvwpgx3pkgCjHYlEU7/3lMp9aI6igiLZvPfzfDC7OgMX Wsd49KcP5xNDf+bFCFCv7zBUjqqmHmjOoYNvQbX4AEagMOvgYDKKLui0miE/r8OCKaxn zHoLwHl+4QvCz8+cvMcHkx6I+a8CHN/c4dKWw/qSdlvTYZpiphPWICSIhRggkvErrSBH qpRm2ISaMW7N5kM8StkXxwL3P+RCIG0aPJ5/LURHzbUOr9QJJ/4yFv75ZlUUAKeFH7bg fA== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3gfvha3u29-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jun 2022 18:28:42 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 41FD010002A; Mon, 6 Jun 2022 18:28:42 +0200 (CEST) Received: from Webmail-eu.st.com (shfdag1node1.st.com [10.75.129.69]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id 3BA53231DC0; Mon, 6 Jun 2022 18:28:42 +0200 (CEST) Received: from localhost (10.75.127.44) by SHFDAG1NODE1.st.com (10.75.129.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.2308.20; Mon, 6 Jun 2022 18:28:42 +0200 From: Antonio Borneo To: Thomas Gleixner , Marc Zyngier , Maxime Coquelin , Alexandre Torgue , , , CC: Antonio Borneo , Ludovic Barre , Loic Pallardy , Pascal Paillet Subject: [PATCH v2 3/6] irqchip/stm32-exti: Prevent illegal read due to unbounded DT value Date: Mon, 6 Jun 2022 18:27:54 +0200 Message-ID: <20220606162757.415354-4-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com> References: <20220510164123.557921-1-antonio.borneo@foss.st.com> MIME-Version: 1.0 X-Originating-IP: [10.75.127.44] X-ClientProxiedBy: SFHDAG2NODE2.st.com (10.75.127.5) To SHFDAG1NODE1.st.com (10.75.129.69) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.874,Hydra:6.0.517,FMLib:17.11.64.514 definitions=2022-06-06_04,2022-06-03_01,2022-02-23_01 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220606_092910_519953_5460FDDE X-CRM114-Status: GOOD ( 15.21 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The value hwirq is received from DT. If it exceeds the maximum valid value it causes the code to address unexisting irq chips reading outside the array boundary. Check the value of hwirq before using it. Signed-off-by: Antonio Borneo --- drivers/irqchip/irq-stm32-exti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c index 1145f064faa8..e2722e499ae5 100644 --- a/drivers/irqchip/irq-stm32-exti.c +++ b/drivers/irqchip/irq-stm32-exti.c @@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, int bank; hwirq = fwspec->param[0]; + if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK) + return -EINVAL; + bank = hwirq / IRQS_PER_BANK; chip_data = &host_data->chips_data[bank];