Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp1304719pxb; Wed, 3 Nov 2021 23:10:41 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz3ewp5h9+ba1xhmmHdVyEB4uyD1848Um40XTQBUlxmWe7n2x+Blxe396k5DxqXqCwRbP+b X-Received: by 2002:a17:906:2f97:: with SMTP id w23mr52118102eji.31.1636006241061; Wed, 03 Nov 2021 23:10:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1636006241; cv=none; d=google.com; s=arc-20160816; b=XL1v6Pk/NE8jQtNnuvWmOBZrnhiWff0gyvv8MU6f3iSPkKfx8NcciBUZKQ3J9QJmCM jrN9vpnUmAgzlfL7z7N94h6ahMWDatpkeMi7eCBSaHbOKwNIk/2zDgmQvl6UHzvjRdPw cRuq9nOPh92bEoPVnA2ZIyXJ8tzMrn/itqfM18qeWV/dXx8HmlUn1Y6DrkTRBlijKEzD LgmQq8VurzAMSE10LFHPDDer6SFBkTLqoT0GrCaiaPbNc6ck5iuXx4aWoklZ4zCB2qDo SW60b36YdkTrVJ1y3E6fbmFJLTqosdFGRFW5xOaZfpJtIFfOQMImfBFsT94Ob/di2v8+ GXoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:dkim-signature; bh=YgOlS4XQGFbDGGA9yOaNi3IdqlxayCGPJqeijiYHEE0=; b=xqHu3FetGkRoXIWRz2+P0E9e0VdQmuEL4zwqYuf40S2gGyIGvIRlSIzhGLG/qSwsL6 4zlz4tJbRV52rhdHQKMolb4lwJmK+fYucV+iOUGo2cDLrVdh1K1WGvD6TAmh7rsWo9bZ 8X5s32hLXcc+nYmMv+IdRXkAguf0QufdRE484XVVonLPoBecq3ZvDMU8zYkFVUnEeCsq L0LmbWQwVUUDMJCq0avfpQhOfqx4ae5N1sZ6LFz5bhnYs2DZuE2wZxdAj3+Lk1m3x3kT I3KUt20KjG5OT0GFPafcU9rf3Cw4Zn+CJNd/nalz7Sx9wE7j5KHwu2AV7mrEV0Wh03yy qtUg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Ifwmvxhg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id u1si6681911edo.537.2021.11.03.23.10.14; Wed, 03 Nov 2021 23:10:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Ifwmvxhg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230218AbhKDGKq (ORCPT + 99 others); Thu, 4 Nov 2021 02:10:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:48370 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229912AbhKDGKp (ORCPT ); Thu, 4 Nov 2021 02:10:45 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C7521610FC; Thu, 4 Nov 2021 06:08:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1636006087; bh=u78YSZDJYfigsy7GL5G4yNXKMBMaWKzma9S8XVynMwU=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=IfwmvxhgW5ygKsNG9ghm67gSI+9in4oE7VZi3M9NdBRTc7q7OKEc/v9JxqqreH519 2FgObB627O+Vd4jwdfJjO+vKq6HIQ1097QFpWEgz7T3mJtq1yn/zcLC5L3r7oFb0uY i0K9/lkCxsDNYzEy/5aKapx0UOzDqPa2MKAwCWPKaupiAxQzmJVXPaGAe0fl/HATd6 XTeA4CgrxElzaF7mL/u2mVC3dk8EwlFUf1IvUrIxBoD8M9b81zZU21V2OdgCHVricw DQwL36KZEUr2jTz3eD2ZHvydn6x7uzu633WI34AZjYV38KfCuGkm5syr1MYN23ozmH h8vxWyWrUh1hg== Received: by mail-ed1-f52.google.com with SMTP id f8so17633091edy.4; Wed, 03 Nov 2021 23:08:07 -0700 (PDT) X-Gm-Message-State: AOAM532I4UpweDp5D1l87q2x5FY6F25ofghiOrm355o9QLPvC3l89Bhk Irtm4xwvx8uG3n6mMcoW1tGyuoJPUkyd/LG1ryg= X-Received: by 2002:a50:bf48:: with SMTP id g8mr67634296edk.10.1636006086162; Wed, 03 Nov 2021 23:08:06 -0700 (PDT) MIME-Version: 1.0 References: <20211104014039.26772-1-zhiyong.tao@mediatek.com> <20211104014039.26772-2-zhiyong.tao@mediatek.com> In-Reply-To: <20211104014039.26772-2-zhiyong.tao@mediatek.com> From: Sean Wang Date: Wed, 3 Nov 2021 23:07:55 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] pinctrl: mediatek: fix global-out-of-bounds issue To: Zhiyong Tao Cc: Rob Herring , Linus Walleij , Mark Rutland , Matthias Brugger , srv_heupstream , hui.liu@mediatek.com, Light Hsieh , =?UTF-8?B?U2VhbiBXYW5nICjnjovlv5fkupgp?= , Seiya Wang , rex-bc.chen@mediatek.com, "open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS" , lkml , linux-arm Mailing List , "moderated list:ARM/Mediatek SoC support" , "open list:GPIO SUBSYSTEM" , Guodong Liu Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org HI, Zhiyong On Wed, Nov 3, 2021 at 6:40 PM Zhiyong Tao wrote: > > From: Guodong Liu > > When eint virtual eint number is greater than gpio number, > it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue. > > Signed-off-by: Zhiyong Tao > Signed-off-by: Guodong Liu > --- > drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c > index 45ebdeba985a..9d57c897835c 100644 > --- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c > +++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c > @@ -286,7 +286,8 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n, > *gpio_chip = &hw->chip; > > /* Be greedy to guess first gpio_n is equal to eint_n */ > - if (desc[eint_n].eint.eint_n == eint_n) > + if (((*gpio_chip)->ngpio > eint_n) && please use "hw->soc->npins > eint_n" to perform the boundary check to be consistent with the other places for the same purpose > + desc[eint_n].eint.eint_n == eint_n) > *gpio_n = eint_n; > else > *gpio_n = mtk_xt_find_eint_num(hw, eint_n); > -- > 2.25.1 >