[PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value

From: Antonio Borneo <antonio.borneo@foss.st.com>
To: Thomas Gleixner <tglx@linutronix.de>,
	Marc Zyngier <maz@kernel.org>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@foss.st.com>,
	<linux-kernel@vger.kernel.org>,
	<linux-stm32@st-md-mailman.stormreply.com>,
	<linux-arm-kernel@lists.infradead.org>
Cc: Antonio Borneo <antonio.borneo@foss.st.com>,
	Ludovic Barre <ludovic.barre@foss.st.com>,
	Loic Pallardy <loic.pallardy@foss.st.com>,
	Pascal Paillet <p.paillet@foss.st.com>
Subject: [PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value
Date: Tue, 10 May 2022 18:41:21 +0200	[thread overview]
Message-ID: <20220510164123.557921-5-antonio.borneo@foss.st.com> (raw)
In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com>

The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips.

Check the value of hwirq before using it.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/irqchip/irq-stm32-exti.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 3f6d524a87fe..509a4a96a99b 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -724,6 +724,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm,
 	int bank;
 
 	hwirq = fwspec->param[0];
+	if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)
+		return -EINVAL;
+
 	bank  = hwirq / IRQS_PER_BANK;
 	chip_data = &host_data->chips_data[bank];
 
-- 
2.36.0

