* [REPORT][next] pinctrl: pinctrl-microchip-sgpio: out-of-bounds bug in sgpio_clrsetbits()
@ 2021-02-02 11:34 Gustavo A. R. Silva
2021-02-03 12:00 ` Lars Povlsen
0 siblings, 1 reply; 2+ messages in thread
From: Gustavo A. R. Silva @ 2021-02-02 11:34 UTC (permalink / raw)
To: Lars Povlsen, Steen Hegelund, UNGLinuxDriver, Linus Walleij
Cc: linux-arm-kernel, linux-gpio, linux-kernel, linux-hardening
Hi,
While addressing some out-of-bounds warnings, I found the following bug:
drivers/pinctrl/pinctrl-microchip-sgpio.c:154:57: warning: array subscript 10 is above array bounds of ‘const u8[10]’ {aka ‘const unsigned char[10]’} [-Warray-bounds]
The bug was introduced by commit be2dc859abd4 ("pinctrl: pinctrl-microchip-sgpio: Add irq support (for sparx5)"):
575 sgpio_clrsetbits(bank->priv, REG_INT_TRIGGER + SGPIO_MAX_BITS, addr.bit,
576 BIT(addr.port), (!!(type & 0x2)) << addr.port);
REG_INT_TRIGGER + SGPIO_MAX_BITS turns out to be 10, which is outside the boundaries
of priv->properties->regoff[] at line 154:
151 static inline void sgpio_clrsetbits(struct sgpio_priv *priv,
152 u32 rno, u32 off, u32 clear, u32 set)
153 {
154 u32 __iomem *reg = &priv->regs[priv->properties->regoff[rno] + off];
155 u32 val = readl(reg);
156
157 val &= ~clear;
158 val |= set;
159
160 writel(val, reg);
161 }
because priv->properties->regoff[] is an array of MAXREG elements, with MAXREG
representing the value of 10 in the following enum:
28 enum {
29 REG_INPUT_DATA,
30 REG_PORT_CONFIG,
31 REG_PORT_ENABLE,
32 REG_SIO_CONFIG,
33 REG_SIO_CLOCK,
34 REG_INT_POLARITY,
35 REG_INT_TRIGGER,
36 REG_INT_ACK,
37 REG_INT_ENABLE,
38 REG_INT_IDENT,
39 MAXREG
40 };
52 struct sgpio_properties {
53 int arch;
54 int flags;
55 u8 regoff[MAXREG];
56 };
Thanks
--
Gustavo
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [REPORT][next] pinctrl: pinctrl-microchip-sgpio: out-of-bounds bug in sgpio_clrsetbits()
2021-02-02 11:34 [REPORT][next] pinctrl: pinctrl-microchip-sgpio: out-of-bounds bug in sgpio_clrsetbits() Gustavo A. R. Silva
@ 2021-02-03 12:00 ` Lars Povlsen
0 siblings, 0 replies; 2+ messages in thread
From: Lars Povlsen @ 2021-02-03 12:00 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Lars Povlsen, Steen Hegelund, UNGLinuxDriver, Linus Walleij,
linux-arm-kernel, linux-gpio, linux-kernel, linux-hardening
Gustavo A. R. Silva writes:
> Hi,
>
> While addressing some out-of-bounds warnings, I found the following bug:
>
> drivers/pinctrl/pinctrl-microchip-sgpio.c:154:57: warning: array subscript 10 is above array bounds of ‘const u8[10]’ {aka ‘const unsigned char[10]’} [-Warray-bounds]
>
> The bug was introduced by commit be2dc859abd4 ("pinctrl: pinctrl-microchip-sgpio: Add irq support (for sparx5)"):
>
> 575 sgpio_clrsetbits(bank->priv, REG_INT_TRIGGER + SGPIO_MAX_BITS, addr.bit,
> 576 BIT(addr.port), (!!(type & 0x2)) << addr.port);
>
> REG_INT_TRIGGER + SGPIO_MAX_BITS turns out to be 10, which is outside the boundaries
> of priv->properties->regoff[] at line 154:
Hi Gustavo!
Thanks for spotting this - the "+" is misplaced. I will submit a patch
asap.
Cheers,
---Lars
>
> 151 static inline void sgpio_clrsetbits(struct sgpio_priv *priv,
> 152 u32 rno, u32 off, u32 clear, u32 set)
> 153 {
> 154 u32 __iomem *reg = &priv->regs[priv->properties->regoff[rno] + off];
> 155 u32 val = readl(reg);
> 156
> 157 val &= ~clear;
> 158 val |= set;
> 159
> 160 writel(val, reg);
> 161 }
>
> because priv->properties->regoff[] is an array of MAXREG elements, with MAXREG
> representing the value of 10 in the following enum:
>
> 28 enum {
> 29 REG_INPUT_DATA,
> 30 REG_PORT_CONFIG,
> 31 REG_PORT_ENABLE,
> 32 REG_SIO_CONFIG,
> 33 REG_SIO_CLOCK,
> 34 REG_INT_POLARITY,
> 35 REG_INT_TRIGGER,
> 36 REG_INT_ACK,
> 37 REG_INT_ENABLE,
> 38 REG_INT_IDENT,
> 39 MAXREG
> 40 };
>
> 52 struct sgpio_properties {
> 53 int arch;
> 54 int flags;
> 55 u8 regoff[MAXREG];
> 56 };
>
> Thanks
--
Lars Povlsen,
Microchip
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-02-03 12:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-02 11:34 [REPORT][next] pinctrl: pinctrl-microchip-sgpio: out-of-bounds bug in sgpio_clrsetbits() Gustavo A. R. Silva
2021-02-03 12:00 ` Lars Povlsen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).