All of lore.kernel.org
 help / color / mirror / Atom feed
From: Antonio Borneo <antonio.borneo@foss.st.com>
To: Thomas Gleixner <tglx@linutronix.de>,
	Marc Zyngier <maz@kernel.org>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@foss.st.com>,
	<linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>,
	<linux-stm32@st-md-mailman.stormreply.com>
Cc: Antonio Borneo <antonio.borneo@foss.st.com>,
	Ludovic Barre <ludovic.barre@foss.st.com>,
	Loic Pallardy <loic.pallardy@foss.st.com>,
	Pascal Paillet <p.paillet@foss.st.com>
Subject: [PATCH v2 3/6] irqchip/stm32-exti: Prevent illegal read due to unbounded DT value
Date: Mon, 6 Jun 2022 18:27:54 +0200	[thread overview]
Message-ID: <20220606162757.415354-4-antonio.borneo@foss.st.com> (raw)
In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com>

The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips
reading outside the array boundary.

Check the value of hwirq before using it.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/irqchip/irq-stm32-exti.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 1145f064faa8..e2722e499ae5 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm,
 	int bank;
 
 	hwirq = fwspec->param[0];
+	if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)
+		return -EINVAL;
+
 	bank  = hwirq / IRQS_PER_BANK;
 	chip_data = &host_data->chips_data[bank];
 
-- 
2.36.1


WARNING: multiple messages have this Message-ID (diff)
From: Antonio Borneo <antonio.borneo@foss.st.com>
To: Thomas Gleixner <tglx@linutronix.de>,
	Marc Zyngier <maz@kernel.org>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@foss.st.com>,
	<linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>,
	<linux-stm32@st-md-mailman.stormreply.com>
Cc: Antonio Borneo <antonio.borneo@foss.st.com>,
	Ludovic Barre <ludovic.barre@foss.st.com>,
	Loic Pallardy <loic.pallardy@foss.st.com>,
	Pascal Paillet <p.paillet@foss.st.com>
Subject: [PATCH v2 3/6] irqchip/stm32-exti: Prevent illegal read due to unbounded DT value
Date: Mon, 6 Jun 2022 18:27:54 +0200	[thread overview]
Message-ID: <20220606162757.415354-4-antonio.borneo@foss.st.com> (raw)
In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com>

The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips
reading outside the array boundary.

Check the value of hwirq before using it.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/irqchip/irq-stm32-exti.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 1145f064faa8..e2722e499ae5 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm,
 	int bank;
 
 	hwirq = fwspec->param[0];
+	if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)
+		return -EINVAL;
+
 	bank  = hwirq / IRQS_PER_BANK;
 	chip_data = &host_data->chips_data[bank];
 
-- 
2.36.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2022-06-06 16:29 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-10 16:41 [PATCH 1/7] irqchip/stm32-exti: set_affinity return IRQ_SET_MASK_OK_DONE if no parent Antonio Borneo
2022-05-10 16:41 ` Antonio Borneo
2022-05-10 16:41 ` [PATCH 2/7] irqchip/stm32-exti: manage IMR at each mask/unmask for direct event Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-11  8:04   ` Marc Zyngier
2022-05-11  8:04     ` Marc Zyngier
2022-05-10 16:41 ` [PATCH 3/7] irqchip/stm32-exti: remove EMR register access for stm32mp15 Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-10 18:38   ` Marc Zyngier
2022-05-10 18:38     ` Marc Zyngier
2022-05-10 16:41 ` [PATCH 4/7] irqchip/stm32-exti: forward irq_request_resources to parent Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-10 18:44   ` Marc Zyngier
2022-05-10 18:44     ` Marc Zyngier
2022-05-11 14:55     ` Antonio Borneo
2022-05-11 14:55       ` Antonio Borneo
2022-05-12 10:04       ` Marc Zyngier
2022-05-10 16:41 ` [PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-10 16:41 ` [PATCH 6/7] irqchip/stm32-exti: read event trigger type from event_trg register Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-10 16:41 ` [PATCH 7/7] irqchip/stm32-exti: simplify irq description table Antonio Borneo
2022-05-10 16:41   ` Antonio Borneo
2022-05-10 18:34 ` [PATCH 1/7] irqchip/stm32-exti: set_affinity return IRQ_SET_MASK_OK_DONE if no parent Marc Zyngier
2022-05-10 18:34   ` Marc Zyngier
2022-05-11  6:39   ` Antonio Borneo
2022-05-11  6:39     ` Antonio Borneo
2022-05-11  8:09     ` Marc Zyngier
2022-05-11  8:09       ` Marc Zyngier
2022-06-06 16:27 ` [PATCH v2 0/6] irqchip/stm32-exti: Fixes and simplifications Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-04 12:56   ` Antonio Borneo
2022-07-04 12:56     ` Antonio Borneo
2022-06-06 16:27 ` [PATCH v2 1/6] irqchip/stm32-exti: Fix irq_set_affinity return value Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Ludovic Barre
2022-06-06 16:27 ` [PATCH v2 2/6] irqchip/stm32-exti: Fix irq_mask/irq_unmask for direct events Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Loic Pallardy
2022-06-06 16:27 ` Antonio Borneo [this message]
2022-06-06 16:27   ` [PATCH v2 3/6] irqchip/stm32-exti: Prevent illegal read due to unbounded DT value Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Antonio Borneo
2022-06-06 16:27 ` [PATCH v2 4/6] irqchip/stm32-exti: Tag emr register as undefined for stm32mp15 Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Alexandre Torgue
2022-06-06 16:27 ` [PATCH v2 5/6] irqchip/stm32-exti: Read event trigger type from event_trg register Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Antonio Borneo
2022-06-06 16:27 ` [PATCH v2 6/6] irqchip/stm32-exti: Simplify irq description table Antonio Borneo
2022-06-06 16:27   ` Antonio Borneo
2022-07-07  8:15   ` [irqchip: irq/irqchip-next] " irqchip-bot for Antonio Borneo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220606162757.415354-4-antonio.borneo@foss.st.com \
    --to=antonio.borneo@foss.st.com \
    --cc=alexandre.torgue@foss.st.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-stm32@st-md-mailman.stormreply.com \
    --cc=loic.pallardy@foss.st.com \
    --cc=ludovic.barre@foss.st.com \
    --cc=maz@kernel.org \
    --cc=mcoquelin.stm32@gmail.com \
    --cc=p.paillet@foss.st.com \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.