* [PATCH] regulator: max77802: Bounds check regulator id against opmode
@ 2023-01-27 22:52 Kees Cook
2023-01-28 7:22 ` Javier Martinez Canillas
2023-01-28 17:19 ` Mark Brown
0 siblings, 2 replies; 3+ messages in thread
From: Kees Cook @ 2023-01-27 22:52 UTC (permalink / raw)
To: Javier Martinez Canillas
Cc: Kees Cook, Liam Girdwood, Mark Brown, linux-kernel, linux-hardening
Explicitly bounds-check the id before accessing the opmode array. Seen
with GCC 13:
../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':
../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
| ~~~~~~~~~~~~~~~~^~~~
../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
62 | unsigned int opmode[MAX77802_REG_MAX];
| ^~~~~~
Cc: Javier Martinez Canillas <javier@dowhile0.org>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++--------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c
index 21e0eb0f43f9..befe5f319819 100644
--- a/drivers/regulator/max77802-regulator.c
+++ b/drivers/regulator/max77802-regulator.c
@@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
{
unsigned int val = MAX77802_OFF_PWRREQ;
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
max77802->opmode[id] = val;
return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
rdev->desc->enable_mask, val << shift);
@@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
unsigned int val;
int shift = max77802_get_opmode_shift(id);
@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
return -EINVAL;
}
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
+
max77802->opmode[id] = val;
return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
rdev->desc->enable_mask, val << shift);
@@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
static unsigned max77802_get_mode(struct regulator_dev *rdev)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
return max77802_map_mode(max77802->opmode[id]);
}
@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
unsigned int mode)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
unsigned int val;
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
+
/*
* If the regulator has been disabled for suspend
* then is invalid to try setting a suspend mode.
@@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
static int max77802_enable(struct regulator_dev *rdev)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)
for (i = 0; i < MAX77802_REG_MAX; i++) {
struct regulator_dev *rdev;
- int id = regulators[i].id;
+ unsigned int id = regulators[i].id;
int shift = max77802_get_opmode_shift(id);
int ret;
@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev)
* the hardware reports OFF as the regulator operating mode.
* Default to operating mode NORMAL in that case.
*/
- if (val == MAX77802_STATUS_OFF)
- max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
- else
- max77802->opmode[id] = val;
+ if (id < ARRAY_SIZE(max77802->opmode)) {
+ if (val == MAX77802_STATUS_OFF)
+ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+ else
+ max77802->opmode[id] = val;
+ }
rdev = devm_regulator_register(&pdev->dev,
®ulators[i], &config);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] regulator: max77802: Bounds check regulator id against opmode
2023-01-27 22:52 [PATCH] regulator: max77802: Bounds check regulator id against opmode Kees Cook
@ 2023-01-28 7:22 ` Javier Martinez Canillas
2023-01-28 17:19 ` Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Javier Martinez Canillas @ 2023-01-28 7:22 UTC (permalink / raw)
To: Kees Cook; +Cc: Liam Girdwood, Mark Brown, linux-kernel, linux-hardening
Hello Kees,
On Fri, Jan 27, 2023 at 11:52 PM Kees Cook <keescook@chromium.org> wrote:
>
> Explicitly bounds-check the id before accessing the opmode array. Seen
> with GCC 13:
>
> ../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':
> ../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
> 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
> | ~~~~~~~~~~~~~~~~^~~~
> ../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
> 62 | unsigned int opmode[MAX77802_REG_MAX];
> | ^~~~~~
>
> Cc: Javier Martinez Canillas <javier@dowhile0.org>
> Cc: Liam Girdwood <lgirdwood@gmail.com>
> Cc: Mark Brown <broonie@kernel.org>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++--------
The patch looks good to me.
Acked-by: Javier Martinez Canillas <javierm@redhat.com>
Best regards,
Javier
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] regulator: max77802: Bounds check regulator id against opmode
2023-01-27 22:52 [PATCH] regulator: max77802: Bounds check regulator id against opmode Kees Cook
2023-01-28 7:22 ` Javier Martinez Canillas
@ 2023-01-28 17:19 ` Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Mark Brown @ 2023-01-28 17:19 UTC (permalink / raw)
To: Javier Martinez Canillas, Kees Cook
Cc: Liam Girdwood, linux-kernel, linux-hardening
On Fri, 27 Jan 2023 14:52:07 -0800, Kees Cook wrote:
> Explicitly bounds-check the id before accessing the opmode array. Seen
> with GCC 13:
>
> ../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':
> ../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
> 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
> | ~~~~~~~~~~~~~~~~^~~~
> ../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
> 62 | unsigned int opmode[MAX77802_REG_MAX];
> | ^~~~~~
>
> [...]
Applied to
broonie/regulator.git for-next
Thanks!
[1/1] regulator: max77802: Bounds check regulator id against opmode
commit: 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-01-28 17:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-27 22:52 [PATCH] regulator: max77802: Bounds check regulator id against opmode Kees Cook
2023-01-28 7:22 ` Javier Martinez Canillas
2023-01-28 17:19 ` Mark Brown
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.