From patchwork Tue Nov 7 11:05:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Borneo X-Patchwork-Id: 13448521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E51DCC4332F for ; Tue, 7 Nov 2023 11:06:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=cQ8Cuk8u5sw14PmeWjen3SPJ4Dq7z/ZOVAoqs8HapMY=; b=2vGI3bAOdFBPUl XUvV/WW9uqn0EkrgCnjW3kMx/3szZ77t1spYKnfN/OtyoxDUNvLrETQhtk3aMhPFwAStQt1HZEV+R r+Rw4p85ujOiTHqFKCluNP5xgwMuE536Xs9WTczpxz0X9GKWVXawNUbS2ZWFjdjBZemAlY/LA02Ho U5LWVvEhny0w1WDSAEVfFBUNTXZMzWmSsjq3VbBpntPre8EMS2OdyXgYzFO4iN/LrkdSPPL1hooR7 pNMIehSFKHcM85pVTGm3/rwI6t+Ip5xUTJb855q4rpzUYWZDSpzOPQIzWX7U1HwwFxnyg3c4CGLYf 2kXp+aepBOesf3jnJhAA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1r0JuW-001BmE-0r; Tue, 07 Nov 2023 11:06:20 +0000 Received: from mx08-00178001.pphosted.com ([91.207.212.93] helo=mx07-00178001.pphosted.com) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1r0JuS-001Bl6-23 for linux-arm-kernel@lists.infradead.org; Tue, 07 Nov 2023 11:06:18 +0000 Received: from pps.filterd (m0046661.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.22/8.17.1.22) with ESMTP id 3A7Ab30n023702; Tue, 7 Nov 2023 12:06:00 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h= from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding:content-type; s=selector1; bh=GsZbf1O usFrNfhIV1CDJxzRVyg3nK7nEux7A+R3rSug=; b=C94JsqqU67pqRk8zLjuDXnx DwAMqHuToFm3IR1gYqfTMzGtQvaWcmM7E8rnXvRCG5X7pmSHb9v4j+LzeNkTl5DA +2tl6wKCXhrk1oWV6cWL0z/2pxyAab/Yb/pNpq3UvQhx4iUhW6Y2Wzwr3t25B8CD Q+dWHcnGgxe0LLkRuc+guJLuctCoM/L1NhWgYhrsBfuPKPVozaolzDhN7/MS/uSp eZiqIv3afNqQp/xfKESkXtxwNjI8+JpEL2RMMx7SyJDlT1fb4c+Vey+HpJ/hsDYJ F++jJrm9Cd8Pj+Hrf74xu/kwmMYeDZK482St4Vj629/FLFLnhDZnPzMC6zSKiqA= = Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3u5ehtks2f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Nov 2023 12:06:00 +0100 (CET) Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id E012D100059; Tue, 7 Nov 2023 12:05:58 +0100 (CET) Received: from Webmail-eu.st.com (shfdag1node1.st.com [10.75.129.69]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id D2FB121ADBC; Tue, 7 Nov 2023 12:05:58 +0100 (CET) Received: from localhost (10.201.20.114) by SHFDAG1NODE1.st.com (10.75.129.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 7 Nov 2023 12:05:58 +0100 From: Antonio Borneo To: Linus Walleij , Maxime Coquelin , Alexandre Torgue , Rob Herring , Geert Uytterhoeven , Emil Renner Berthing , Valentin Caron , Dario Binacchi , =?utf-8?q?Bernhard_Ro?= =?utf-8?q?senkr=C3=A4nzer?= CC: Antonio Borneo , , , , Subject: [PATCH] pinctrl: stm32: fix array read out of bound Date: Tue, 7 Nov 2023 12:05:20 +0100 Message-ID: <20231107110520.4449-1-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.42.0 MIME-Version: 1.0 X-Originating-IP: [10.201.20.114] X-ClientProxiedBy: EQNCAS1NODE4.st.com (10.75.129.82) To SHFDAG1NODE1.st.com (10.75.129.69) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.987,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-11-07_01,2023-11-07_01,2023-05-22_02 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231107_030617_184914_170A3FDE X-CRM114-Status: GOOD ( 14.34 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The existing code does not verify if the "tentative" index exceeds the size of the array, causing out of bound read. Issue identified with kasan. Check the index before using it. Signed-off-by: Antonio Borneo Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") --- drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c index a73385a431de..56677bad10f7 100644 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c @@ -1283,9 +1283,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi int i; /* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */ - pin_desc = pctl->pins + stm32_pin_nb; - if (pin_desc->pin.number == stm32_pin_nb) - return pin_desc; + if (stm32_pin_nb < pctl->npins) { + pin_desc = pctl->pins + stm32_pin_nb; + if (pin_desc->pin.number == stm32_pin_nb) + return pin_desc; + } /* Otherwise, loop all array to find the pin with the right number */ for (i = 0; i < pctl->npins; i++) {