[PATCH] regmap: maple: Fix cache corruption in regcache_maple_drop()

[PATCH] regmap: maple: Fix cache corruption in regcache_maple_drop()

[Richard Fitzgerald]

When keeping the upper end of a cache block entry, the entry[] array
must be indexed by the offset from the base register of the block,
i.e. max - mas.index.

The code was indexing entry[] by only the register address, leading
to an out-of-bounds access that copied some part of the kernel
memory over the cache contents.

This bug was not detected by the regmap KUnit test because it only
tests with a block of registers starting at 0, so mas.index == 0.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache")
---
 drivers/base/regmap/regcache-maple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
index 41edd6a430eb..c1776127a572 100644
--- a/drivers/base/regmap/regcache-maple.c
+++ b/drivers/base/regmap/regcache-maple.c
@@ -145,7 +145,7 @@ static int regcache_maple_drop(struct regmap *map, unsigned int min,
 			upper_index = max + 1;
 			upper_last = mas.last;
 
-			upper = kmemdup(&entry[max + 1],
+			upper = kmemdup(&entry[max - mas.index + 1],
 					((mas.last - max) *
 					 sizeof(unsigned long)),
 					map->alloc_flags);
-- 
2.39.2

Re: [PATCH] regmap: maple: Fix cache corruption in regcache_maple_drop()

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 243 bytes --]

On Wed, Mar 27, 2024 at 11:44:06AM +0000, Richard Fitzgerald wrote:

> This bug was not detected by the regmap KUnit test because it only
> tests with a block of registers starting at 0, so mas.index == 0.

Can you please add a test for this?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] regmap: maple: Fix cache corruption in regcache_maple_drop()

[Richard Fitzgerald]

On 27/03/2024 14:16, Mark Brown wrote:
> On Wed, Mar 27, 2024 at 11:44:06AM +0000, Richard Fitzgerald wrote:
> 
>> This bug was not detected by the regmap KUnit test because it only
>> tests with a block of registers starting at 0, so mas.index == 0.
> 
> Can you please add a test for this?

Later, when I have the time.
I've already wasted over a day debugging why the values in my registers
are not correct, so I'm that far behind on the work I should be doing.

Re: [PATCH] regmap: maple: Fix cache corruption in regcache_maple_drop()

[Mark Brown]

On Wed, 27 Mar 2024 11:44:06 +0000, Richard Fitzgerald wrote:
> When keeping the upper end of a cache block entry, the entry[] array
> must be indexed by the offset from the base register of the block,
> i.e. max - mas.index.
> 
> The code was indexing entry[] by only the register address, leading
> to an out-of-bounds access that copied some part of the kernel
> memory over the cache contents.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-next

Thanks!

[1/1] regmap: maple: Fix cache corruption in regcache_maple_drop()
      commit: 00bb549d7d63a21532e76e4a334d7807a54d9f31

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark