From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F6EBC433F5 for ; Tue, 10 May 2022 16:43:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347577AbiEJQrQ (ORCPT ); Tue, 10 May 2022 12:47:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347558AbiEJQq7 (ORCPT ); Tue, 10 May 2022 12:46:59 -0400 Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 027DB45AE7 for ; Tue, 10 May 2022 09:43:01 -0700 (PDT) Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24ADDGfX021731; Tue, 10 May 2022 18:42:53 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=selector1; bh=NXxR6KjIryB6JH8ULR8cGSTm+ddR7AKoQEiQZncoprc=; b=nHf0sAvnvrqEGqCzOruuB+WEz/F3bitqL4ssnKl1AM0TJBixVOxea8DJApg/KDBwleH+ hBFa8ba7NY+LksKShYVAKnBpJDtkWGyiu1hxTvMZQhrVgHk5rqJFNX2O1NBP8BOyz/+i QDRLM4d5g1GsLYKRSClMkJIlDkTEgNn9MS7NU/cTlrb8QeG34O7lKWcrBpHKNcEASOKI Agn1wiFqzas/KXFtppaqXAZypFSlBq3VIyzuDvqZ/vYNB3zkUvBIbRfP+ieXb5Jbob+u yTUrw2rNvM7EBIGeiT+29Iw0hY/M0R6MpmYRbpPOD/FS9qqEnfZMcK1B9UFKb99JF2DL NQ== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3fwdw949bb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 May 2022 18:42:53 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id B891F100038; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from Webmail-eu.st.com (sfhdag2node2.st.com [10.75.127.5]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id B1D6D23152B; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from localhost (10.75.127.47) by SFHDAG2NODE2.st.com (10.75.127.5) with Microsoft SMTP Server (TLS) id 15.0.1497.26; Tue, 10 May 2022 18:42:51 +0200 From: Antonio Borneo To: Thomas Gleixner , Marc Zyngier , Maxime Coquelin , Alexandre Torgue , , , CC: Antonio Borneo , Ludovic Barre , Loic Pallardy , Pascal Paillet Subject: [PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value Date: Tue, 10 May 2022 18:41:21 +0200 Message-ID: <20220510164123.557921-5-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com> References: <20220510164123.557921-1-antonio.borneo@foss.st.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.75.127.47] X-ClientProxiedBy: SFHDAG2NODE2.st.com (10.75.127.5) To SFHDAG2NODE2.st.com (10.75.127.5) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-05-10_04,2022-05-10_01,2022-02-23_01 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The value hwirq is received from DT. If it exceeds the maximum valid value it causes the code to address unexisting irq chips. Check the value of hwirq before using it. Signed-off-by: Antonio Borneo --- drivers/irqchip/irq-stm32-exti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c index 3f6d524a87fe..509a4a96a99b 100644 --- a/drivers/irqchip/irq-stm32-exti.c +++ b/drivers/irqchip/irq-stm32-exti.c @@ -724,6 +724,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, int bank; hwirq = fwspec->param[0]; + if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK) + return -EINVAL; + bank = hwirq / IRQS_PER_BANK; chip_data = &host_data->chips_data[bank]; -- 2.36.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8C37DC433F5 for ; Tue, 10 May 2022 16:44:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=EQD1z0E6uDb/qi2Rm2s4VNk+csdpVtjUhTdCiDUy/h8=; b=nazbXDKO+gQjRX 2FY/LHf4kO4MU+nZpP6PVo4aoO77uMKFT+HQ72t8SdWwH7cmYCki5IGqFGo8C/g+VbQdLL+ioQx3n 8e+jWiIErqEoLfGLIovTOL3z+CiJJ8tnKfs90/TPueYszTguBQGWyu6mxNazgIJj9/Be/qGVSpR9e AyT/S71CkfZxEzKIS8NTA2iQ1ygry0kVVNhpQmeqScgN4e0mpS13MShi9X0em6QTc5IhwY56mYIX/ lh1JnPxfPR26v4TvEt2GtOo74I3kx3ehlPReiRdspxXaoSs1orblGBBMF4hOTnRJYCINeZJ16jYcz IEhKV37tGPeWIU4GWFxA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1noSxU-0039F3-Rn; Tue, 10 May 2022 16:43:37 +0000 Received: from mx08-00178001.pphosted.com ([91.207.212.93] helo=mx07-00178001.pphosted.com) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1noSws-0038x0-Lj for linux-arm-kernel@lists.infradead.org; Tue, 10 May 2022 16:43:00 +0000 Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24ADDGfX021731; Tue, 10 May 2022 18:42:53 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=selector1; bh=NXxR6KjIryB6JH8ULR8cGSTm+ddR7AKoQEiQZncoprc=; b=nHf0sAvnvrqEGqCzOruuB+WEz/F3bitqL4ssnKl1AM0TJBixVOxea8DJApg/KDBwleH+ hBFa8ba7NY+LksKShYVAKnBpJDtkWGyiu1hxTvMZQhrVgHk5rqJFNX2O1NBP8BOyz/+i QDRLM4d5g1GsLYKRSClMkJIlDkTEgNn9MS7NU/cTlrb8QeG34O7lKWcrBpHKNcEASOKI Agn1wiFqzas/KXFtppaqXAZypFSlBq3VIyzuDvqZ/vYNB3zkUvBIbRfP+ieXb5Jbob+u yTUrw2rNvM7EBIGeiT+29Iw0hY/M0R6MpmYRbpPOD/FS9qqEnfZMcK1B9UFKb99JF2DL NQ== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3fwdw949bb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 May 2022 18:42:53 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id B891F100038; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from Webmail-eu.st.com (sfhdag2node2.st.com [10.75.127.5]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id B1D6D23152B; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from localhost (10.75.127.47) by SFHDAG2NODE2.st.com (10.75.127.5) with Microsoft SMTP Server (TLS) id 15.0.1497.26; Tue, 10 May 2022 18:42:51 +0200 From: Antonio Borneo To: Thomas Gleixner , Marc Zyngier , Maxime Coquelin , Alexandre Torgue , , , CC: Antonio Borneo , Ludovic Barre , Loic Pallardy , Pascal Paillet Subject: [PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value Date: Tue, 10 May 2022 18:41:21 +0200 Message-ID: <20220510164123.557921-5-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com> References: <20220510164123.557921-1-antonio.borneo@foss.st.com> MIME-Version: 1.0 X-Originating-IP: [10.75.127.47] X-ClientProxiedBy: SFHDAG2NODE2.st.com (10.75.127.5) To SFHDAG2NODE2.st.com (10.75.127.5) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-05-10_04,2022-05-10_01,2022-02-23_01 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220510_094259_044333_B3F792DA X-CRM114-Status: GOOD ( 15.00 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The value hwirq is received from DT. If it exceeds the maximum valid value it causes the code to address unexisting irq chips. Check the value of hwirq before using it. Signed-off-by: Antonio Borneo --- drivers/irqchip/irq-stm32-exti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c index 3f6d524a87fe..509a4a96a99b 100644 --- a/drivers/irqchip/irq-stm32-exti.c +++ b/drivers/irqchip/irq-stm32-exti.c @@ -724,6 +724,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, int bank; hwirq = fwspec->param[0]; + if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK) + return -EINVAL; + bank = hwirq / IRQS_PER_BANK; chip_data = &host_data->chips_data[bank]; -- 2.36.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel