From patchwork Fri Jul 3 11:15:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Evgeny Novikov X-Patchwork-Id: 11641733 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9CC25912 for ; Fri, 3 Jul 2020 11:17:17 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 74C0A206B6 for ; Fri, 3 Jul 2020 11:17:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="HttXvwVV" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 74C0A206B6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=ispras.ru Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=B0wU+ME9yIuW29t1y3Bu0oe10wJJ/QH8SKiuhwCnbZg=; b=HttXvwVVONxOGUDx1oTft0UpSK ROCWJT7rmPI69LUlIDQZed5dMLT8eP1PyUj7vz609BxjJGNoD6VXLCwpu6gnAVaN4ye/BZBvqastm 7y+8ZbmQJDo2644CSUiCbhyMoMkRnFyUdPhnAdb6+SvoYCebwZyCn/F8QIBJnJdo7UIew+V8MqZZ4 DAPfZHmXqFAz8Ow1lCxIvM6cQaAABKs3VB1gEbmsBEv52t3DLel9ITY7Z2dXFuSvLjEhPUkm0DJUg TNsGfU8saon5vvIIhBbDEhLW16ePglOMp7Q9Yaecmq7TTQVD5G5wL0pNAYx6nEcffPJvXSvRf2fgg x7ofpNqA==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jrJfU-0004B1-E6; Fri, 03 Jul 2020 11:15:44 +0000 Received: from winnie.ispras.ru ([83.149.199.91] helo=smtp.ispras.ru) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jrJfR-00049z-DJ for linux-arm-kernel@lists.infradead.org; Fri, 03 Jul 2020 11:15:42 +0000 Received: from home.intra.ispras.ru (unknown [10.10.165.12]) by smtp.ispras.ru (Postfix) with ESMTP id 8A042203C1; Fri, 3 Jul 2020 14:15:33 +0300 (MSK) From: Evgeny Novikov To: Jean Delvare Subject: [PATCH] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Date: Fri, 3 Jul 2020 14:15:18 +0300 Message-Id: <20200703111518.9644-1-novikov@ispras.ru> X-Mailer: git-send-email 2.16.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200703_071541_592511_D43CFBD7 X-CRM114-Status: UNSURE ( 7.89 ) X-CRM114-Notice: Please train this message. X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-hwmon@vger.kernel.org, ldv-project@linuxtesting.org, linux-aspeed@lists.ozlabs.org, Evgeny Novikov , linux-kernel@vger.kernel.org, Andrew Jeffery , Joel Stanley , Guenter Roeck , linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org aspeed_create_fan() reads a pwm_port value using of_property_read_u32(). If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be a buffer overflow in aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes the potential buffer overflow. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov --- drivers/hwmon/aspeed-pwm-tacho.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c index 33fb54845bf6..3d8239fd66ed 100644 --- a/drivers/hwmon/aspeed-pwm-tacho.c +++ b/drivers/hwmon/aspeed-pwm-tacho.c @@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev, ret = of_property_read_u32(child, "reg", &pwm_port); if (ret) return ret; + if (pwm_port >= ARRAY_SIZE(pwm_port_params)) + return -EINVAL; aspeed_create_pwm_port(priv, (u8)pwm_port); ret = of_property_count_u8_elems(child, "cooling-levels");