Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp6137649iob; Tue, 10 May 2022 11:10:11 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwmxQRiugS0IWz++0HO/F0hIILdia9w3CvNFlRtd3NI5LfX94ScfTTmkX59HC9F+Awt0aWB X-Received: by 2002:a05:6a00:1683:b0:4f7:e497:6a55 with SMTP id k3-20020a056a00168300b004f7e4976a55mr21478130pfc.21.1652206210793; Tue, 10 May 2022 11:10:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1652206210; cv=none; d=google.com; s=arc-20160816; b=BcOV7zrWGx9RffppKhXoQpE05kB3iGv+gxVEPr1t401KIodKkXgDSNDbHYUsMWBUzF 7W7V8m1/OaUwSqo737vWfUQznas/S5Dt43gIR1Iexc1XHfrgLNrrwNCRBraabt5AZkX6 p7S7azaf/o6IpKuS1TOEqlprC8jQ6dYUZ3FO1QqYCEdSPsLkheGGe42H3+LgQLe8XCcN cZfy2raZ2H1xFhIx3M9RjCgCL0hGgalYtg/slNWxwCqUAayQQtuy16UpxWkbyBqzHN4a E1tcBJBaOOkrf01MJFdJZ+fK331trxsEZsEe5FxFHahqQZhhjVtGwNkk3tcCmypEGPC7 5Nnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=NXxR6KjIryB6JH8ULR8cGSTm+ddR7AKoQEiQZncoprc=; b=ZCSzhsMD2l37qvGQ1HZ+k306VRuMh0WVcMuH6E59c33B41MoSTauykCgyWx88IJ1l6 PeiH2PRhgpr8GOY4rAbv3huG6yWxHXC8FD4g/oQhwdO7cz/bDglqmlU9ChVB0kTf9PFR amcJHTITRukoKXRMBJgoSIJPnh/XTKFec3eDYZCXBYJQgJltmulM2xkiZGU5J4aLlZ+8 ll8btC4SD4UMFkjrRBi9+uV0LDeQDj3GvcIUNarNWdlf8km61Yqtxkl4hjWCmdFUbYSS mSeZjyR/DRUfUTCbDQcuQ131nkBkCRMCyysbV7G9XTG1sHOgRNnUsmde2CWkehy/RbvD Md6w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@foss.st.com header.s=selector1 header.b=nHf0sAvn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=foss.st.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z10-20020a170902d54a00b00153b2d165f5si3646974plf.509.2022.05.10.11.09.53; Tue, 10 May 2022 11:10:10 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@foss.st.com header.s=selector1 header.b=nHf0sAvn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=foss.st.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347566AbiEJQrO (ORCPT + 99 others); Tue, 10 May 2022 12:47:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347558AbiEJQq7 (ORCPT ); Tue, 10 May 2022 12:46:59 -0400 Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 027DB45AE7 for ; Tue, 10 May 2022 09:43:01 -0700 (PDT) Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 24ADDGfX021731; Tue, 10 May 2022 18:42:53 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=selector1; bh=NXxR6KjIryB6JH8ULR8cGSTm+ddR7AKoQEiQZncoprc=; b=nHf0sAvnvrqEGqCzOruuB+WEz/F3bitqL4ssnKl1AM0TJBixVOxea8DJApg/KDBwleH+ hBFa8ba7NY+LksKShYVAKnBpJDtkWGyiu1hxTvMZQhrVgHk5rqJFNX2O1NBP8BOyz/+i QDRLM4d5g1GsLYKRSClMkJIlDkTEgNn9MS7NU/cTlrb8QeG34O7lKWcrBpHKNcEASOKI Agn1wiFqzas/KXFtppaqXAZypFSlBq3VIyzuDvqZ/vYNB3zkUvBIbRfP+ieXb5Jbob+u yTUrw2rNvM7EBIGeiT+29Iw0hY/M0R6MpmYRbpPOD/FS9qqEnfZMcK1B9UFKb99JF2DL NQ== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3fwdw949bb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 May 2022 18:42:53 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id B891F100038; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from Webmail-eu.st.com (sfhdag2node2.st.com [10.75.127.5]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id B1D6D23152B; Tue, 10 May 2022 18:42:52 +0200 (CEST) Received: from localhost (10.75.127.47) by SFHDAG2NODE2.st.com (10.75.127.5) with Microsoft SMTP Server (TLS) id 15.0.1497.26; Tue, 10 May 2022 18:42:51 +0200 From: Antonio Borneo To: Thomas Gleixner , Marc Zyngier , Maxime Coquelin , Alexandre Torgue , , , CC: Antonio Borneo , Ludovic Barre , Loic Pallardy , Pascal Paillet Subject: [PATCH 5/7] irqchip/stm32-exti: prevent illegal read due to unbounded DT value Date: Tue, 10 May 2022 18:41:21 +0200 Message-ID: <20220510164123.557921-5-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220510164123.557921-1-antonio.borneo@foss.st.com> References: <20220510164123.557921-1-antonio.borneo@foss.st.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.75.127.47] X-ClientProxiedBy: SFHDAG2NODE2.st.com (10.75.127.5) To SFHDAG2NODE2.st.com (10.75.127.5) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514 definitions=2022-05-10_04,2022-05-10_01,2022-02-23_01 X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The value hwirq is received from DT. If it exceeds the maximum valid value it causes the code to address unexisting irq chips. Check the value of hwirq before using it. Signed-off-by: Antonio Borneo --- drivers/irqchip/irq-stm32-exti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c index 3f6d524a87fe..509a4a96a99b 100644 --- a/drivers/irqchip/irq-stm32-exti.c +++ b/drivers/irqchip/irq-stm32-exti.c @@ -724,6 +724,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, int bank; hwirq = fwspec->param[0]; + if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK) + return -EINVAL; + bank = hwirq / IRQS_PER_BANK; chip_data = &host_data->chips_data[bank]; -- 2.36.0