Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp1668036pxb; Thu, 16 Sep 2021 12:29:18 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwHSk6vDx5Xworw+yGDk70KPNsdecMiXWwY66EtqPzrrzPgpfIZKvJssi5Uu9YF33F/1XTI X-Received: by 2002:a17:906:f92:: with SMTP id q18mr7780340ejj.353.1631820558401; Thu, 16 Sep 2021 12:29:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631820558; cv=none; d=google.com; s=arc-20160816; b=gLVbQdGPz9jB/CqKaGTDYj4lNOcm/CHkYaNYxRebLYNvcmqwE5gi398VcbOe3EzTh3 ZdSCmJTr+kX4bvyTEwCt85cdSIO7T4F2CiMYSuNBBThZvjszDB2c/MvZu0Sxva3fz+WO tAoTnEB0IZoW+fAD1RmVgicre8TsWmndNm4hCxuPlld+xRnKoLDjxpfInByFhNkTPWio dAK8tBqoWN1ArNGDOn8OuF4m1fgVRz/0UZLWImcNJuM8gMJSUej+1JdpJOQuxfl3121T UhR2SGXGBHvSIqsyYNxQqZOUUipQkJlUszOrWddKosFCFg09/xC133JYa9fR2hQqai6M Hi2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=YjZpbbQ4kVx50VDOQbTpeLbHxNGCvSpTsAh2c15LExU=; b=WeAaqaLi2VBaO1cZkVsLkTzocq/+omrZHvisrV63p3OChNKJ5e4br4jgwUMh7KYAZu 9Kx6ejjVIPEuIZBY47ildWmNfJ6+cug9RtRpPfUhidx4ArELj0mTrAepv47pm0SpD1TZ Ge95DRApINzhOAr+c/1182xeLpuoNoXBMeMHni+PDjJmLz8+393j3OjgJMwIXXHIQc9z UUUTtaTlwR+pvydMxYbKkvlpiMJ0nSoRRsXJwDSbTl7UScux659qpSEzeBJYgUjuU3hl YILcP8/6/DQLB6OwXkLxXOkq2tW7BBKmQauZwD/sN7P2yD/OUzagJEHAk/ncnfX8akxJ m5Uw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=gFsq7U0M; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id f16si5496969edf.48.2021.09.16.12.28.54; Thu, 16 Sep 2021 12:29:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=gFsq7U0M; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234037AbhIPQGa (ORCPT + 99 others); Thu, 16 Sep 2021 12:06:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:44906 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240612AbhIPQFn (ORCPT ); Thu, 16 Sep 2021 12:05:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 29DD061241; Thu, 16 Sep 2021 16:04:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1631808262; bh=niG2Lt1Ingh5RIC5tdVdvtYyFU2QIjLuQ49vE2s/LNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gFsq7U0MpFBljMfq1kwkcv2pHWNT1tO+sAoHWKWFm0v3GIYrFKYet6UByL5oFgDOl wiMcpgH9olPy6N2931fRuZ8FGQjNV7Jy6vMKDqYnp6cxB1/xgN2p5uRV+fs1Y6JZI5 1e9yBIUFmQvY3klXcg1kAsM+EnBLbrk4dRLiUAfM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Amelie Delaunay , Linus Walleij , Maxime Coquelin , Alexandre Torgue Subject: [PATCH 5.10 021/306] pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast Date: Thu, 16 Sep 2021 17:56:06 +0200 Message-Id: <20210916155754.661055443@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210916155753.903069397@linuxfoundation.org> References: <20210916155753.903069397@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Marc Zyngier commit 1b73e588f47397dee6e4bdfd953e0306c60b5fe5 upstream. Casting a small array of u8 to an unsigned long is *never* OK: - it does funny thing when the array size is less than that of a long, as it accesses random places in the stack - it makes everything even more fun with a BE kernel Fix this by building the unsigned long used as a bitmap byte by byte, in a way that works across endianess and has no undefined behaviours. An extra BUILD_BUG_ON() catches the unlikely case where the array would be larger than a single unsigned long. Fixes: 1490d9f841b1 ("pinctrl: Add STMFX GPIO expander Pinctrl/GPIO driver") Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Cc: Amelie Delaunay Cc: Linus Walleij Cc: Maxime Coquelin Cc: Alexandre Torgue Link: https://lore.kernel.org/r/20210725180830.250218-1-maz@kernel.org Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman --- drivers/pinctrl/pinctrl-stmfx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/pinctrl/pinctrl-stmfx.c +++ b/drivers/pinctrl/pinctrl-stmfx.c @@ -566,7 +566,7 @@ static irqreturn_t stmfx_pinctrl_irq_thr u8 pending[NR_GPIO_REGS]; u8 src[NR_GPIO_REGS] = {0, 0, 0}; unsigned long n, status; - int ret; + int i, ret; ret = regmap_bulk_read(pctl->stmfx->map, STMFX_REG_IRQ_GPI_PENDING, &pending, NR_GPIO_REGS); @@ -576,7 +576,9 @@ static irqreturn_t stmfx_pinctrl_irq_thr regmap_bulk_write(pctl->stmfx->map, STMFX_REG_IRQ_GPI_SRC, src, NR_GPIO_REGS); - status = *(unsigned long *)pending; + BUILD_BUG_ON(NR_GPIO_REGS > sizeof(status)); + for (i = 0, status = 0; i < NR_GPIO_REGS; i++) + status |= (unsigned long)pending[i] << (i * 8); for_each_set_bit(n, &status, gc->ngpio) { handle_nested_irq(irq_find_mapping(gc->irq.domain, n)); stmfx_pinctrl_irq_toggle_trigger(pctl, n);