Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   peng.fan@nxp.com
To:     broonie@kernel.org, gregkh@linuxfoundation.org, rafael@kernel.org
Cc:     linux-imx@nxp.com, linux-kernel@vger.kernel.org,
        Peng Fan <peng.fan@nxp.com>
Subject: [PATCH] regmap: debugfs: check count when read regmap file
Date:   Sun,  8 Mar 2020 21:10:58 +0800
Message-Id: <1583673058-20531-1-git-send-email-peng.fan@nxp.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost.localdomain (119.31.174.66) by SG2PR01CA0135.apcprd01.prod.exchangelabs.com (2603:1096:4:8f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2793.14 via Frontend Transport; Sun, 8 Mar 2020 13:17:25 +0000
X-Mailer: git-send-email 2.7.4
X-Originating-IP: [119.31.174.66]
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: ffe537b4-dbfb-4d0b-55c9-08d7c3630c62
X-MS-TrafficTypeDiagnostic: AM0PR04MB6321:|AM0PR04MB6321:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <AM0PR04MB6321DDED501531200CE2845E88E10@AM0PR04MB6321.eurprd04.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:7691;
X-Forefront-PRVS: 03361FCC43
X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4636009)(346002)(396003)(366004)(136003)(39860400002)(376002)(199004)(189003)(316002)(6506007)(66946007)(52116002)(5660300002)(81166006)(81156014)(45080400002)(66476007)(6666004)(16526019)(478600001)(36756003)(66556008)(26005)(186003)(8676002)(6486002)(69590400007)(8936002)(9686003)(6512007)(4326008)(2906002)(956004)(2616005)(86362001);DIR:OUT;SFP:1101;SCL:1;SRVR:AM0PR04MB6321;H:AM0PR04MB4481.eurprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
Received-SPF: None (protection.outlook.com: nxp.com does not designate
 permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: eY6QaxtkzaxqN/PEQeWqxX5JJBNq6XufvBBc0i5WuINJ69MJKWCky5jHogG5llhLaDg7D1xsPww0QeGF9Da+SN+kjmSVNolq1u+eimGMizaroPsJc4jYSXjmjSkUljUq5ka1eIuIcg6r2/SEPS4wmn7hjsLkO0QQWC3GTWK3OKBbIuw/yeGDphV/+NCmEBuSpVdRg/b/iWK81hDe9JZc7gcK4zyaiWBgly2w4r5EhUGt98CBC/NQv2ObzpIvkYK+YOFLzYpO1CLOW3+amDvYe6ZGbKW2MVDnyGMCXCbRc5cYfjT+G526fmdoQorMBwQEr+6FczYDcFtgb6ivkOV0OE2ZYVUTt6Swwg1Bd0SNhQ7yxzrwHbHbP1ljU0Qj6WKXPBjhFEP8rwR48XSOyW3IUKZYhNPNDp4v6T+rfaM5vAARfijnehoiiz06mnxEVF+CFdEry3luO7fzgnObNi+vecWnFvnX+H2YPjF4++L3WZastmqlWU2EsSIuepku8xcV
X-MS-Exchange-AntiSpam-MessageData: xlybp++0DPzMsjOKdlQcTOCUZDleNcWp2568sacUSPMfyVHAjKK2qn8b9jeJcti+ysNolY9PLW2f2BDWqt3wfVxuONOCylAtkDJq+ELbUBsli5X2sgAWmUOghIMBbMtqfNbY8d13vaO1zsbkz9dS8w==
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ffe537b4-dbfb-4d0b-55c9-08d7c3630c62
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2020 13:17:27.5962
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3ilC9IYyKoyuxTsA+4YaMUzIjwgrP5GSCkJcseNaFbSiHbuGkddjAx6lhuQhLAvRYjXC9zOGBDb8OMAZ0JCD6g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6321
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Peng Fan <peng.fan@nxp.com>

When executing the following command, we met kernel dump.
dmesg -c > /dev/null; cd /sys;
for i in `ls /sys/kernel/debug/regmap/* -d`; do
	echo "Checking regmap in $i";
	cat $i/registers;
done && grep -ri "0x02d0" *;

------------[ cut here ]------------
WARNING: CPU: 0 PID: 6406 at mm/page_alloc.c:4738 __alloc_pages_nodemask+0x2c8/0xda4
Modules linked in: mx6s_capture ov5640_camera_v2 galcore(O) [last unloaded: snvs_ui]
CPU: 0 PID: 6406 Comm: grep Tainted: G           O      5.4.3-lts-lf-5.4.y+g54cbaf43e23e #1
Hardware name: Freescale i.MX6 SoloX (Device Tree)
[<80110770>] (unwind_backtrace) from [<8010b650>] (show_stack+0x10/0x14)
[<8010b650>] (show_stack) from [<80b3770c>] (dump_stack+0x90/0xa4)
[<80b3770c>] (dump_stack) from [<80130310>] (__warn+0xbc/0xd8)
[<80130310>] (__warn) from [<80130390>] (warn_slowpath_fmt+0x64/0xc4)
[<80130390>] (warn_slowpath_fmt) from [<80214328>] (__alloc_pages_nodemask+0x2c8/0xda4)
[<80214328>] (__alloc_pages_nodemask) from [<801f4ba8>] (kmalloc_order+0x1c/0x4c)
[<801f4ba8>] (kmalloc_order) from [<8061e360>] (regmap_read_debugfs+0x64/0x39c)
[<8061e360>] (regmap_read_debugfs) from [<8061e6f0>] (regmap_map_read_file+0x28/0x30)
[<8061e6f0>] (regmap_map_read_file) from [<803c0614>] (full_proxy_read+0x54/0x70)
[<803c0614>] (full_proxy_read) from [<8022c68c>] (__vfs_read+0x30/0x1c4)
[<8022c68c>] (__vfs_read) from [<8022c8b4>] (vfs_read+0x94/0x110)
[<8022c8b4>] (vfs_read) from [<8022cb98>] (ksys_read+0x64/0xec)
[<8022cb98>] (ksys_read) from [<80101000>] (ret_fast_syscall+0x0/0x54)
Exception stack(0xa868bfa8 to 0xa868bff0)
bfa0:                   03001000 03000000 00000006 70e0e000 03000000 00000000
bfc0: 03001000 03000000 76fa53d0 00000003 00000006 70e0d008 00040298 70e0e000
bfe0: 00000003 7ead45a0 76ea2cd7 76e2ed16
---[ end trace f0a1fccbc20d20ff ]---

It is because the count value is too big, and kmalloc fails.
So add a check to allow only max->max_register as max count.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/base/regmap/regmap-debugfs.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index e72843fe41df..a375cb2ebac9 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -283,9 +283,10 @@ static ssize_t regmap_map_read_file(struct file *file, char __user *user_buf,
 				    size_t count, loff_t *ppos)
 {
 	struct regmap *map = file->private_data;
+	size_t num = count > map->max_register ? map->max_register : count;
 
 	return regmap_read_debugfs(map, 0, map->max_register, user_buf,
-				   count, ppos);
+				   num, ppos);
 }
 
 #undef REGMAP_ALLOW_WRITE_DEBUGFS
@@ -371,6 +372,8 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
 	if (*ppos < 0 || !count)
 		return -EINVAL;
 
+	count = (count + *ppos) > map->max_register ? map->max_register : count;
+
 	buf = kmalloc(count, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
-- 
2.16.4