Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Xiaolei Wang <xiaolei.wang@windriver.com>
To:     lgirdwood@gmail.com, broonie@kernel.org
Cc:     linux-kernel@vger.kernel.org
Subject: [PATCH] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
Date:   Thu, 25 Aug 2022 15:15:41 +0800
Message-Id: <20220825071541.1228110-1-xiaolei.wang@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Q6NVb3difQfhq3SQYKXsz0FVFKBW+VmmWblAZnU/YILY3nYf6OozOHY8LOl+?=
 =?us-ascii?Q?/dNbr6PCv6MLjR/PdONm8ZLO7BUKCm6WtOkG5fANspGekuImU+b3QTsESuhx?=
 =?us-ascii?Q?zIe96uhE8UkGiGWFVbVsbaiVQCvtoj8R0GpiCwrxzyqwJkgVl4QNtwM+8TDQ?=
 =?us-ascii?Q?Eun2C/opxfsJNksx748pd8SZdgYbqzGMg7X1gHJuDwx6WwEPe5CmWCZ8GjjM?=
 =?us-ascii?Q?Gym6T6UVZZWZOhn1kIzT8vLif1a3c28dySlSDtV749HPIYYzpIO/LhtQ9Pqb?=
 =?us-ascii?Q?9MTEExEpSu4bGKtr8ZO1PfITYbSRnUzjZuRbQFdFRNWcpRvlrKOORi3EPWRL?=
 =?us-ascii?Q?uzXWs1C41b1e9FsXzpWXdCGsLk/XH2APUDObo+sOWzLHyxOdn+YO0JKVsgTe?=
 =?us-ascii?Q?3xly0R7UkC2Nj9GeWPWkCmAvGZZPacGH472dvM2YhtGi/OIeMNA3Q4rtZK/L?=
 =?us-ascii?Q?tZ7P+Dttm+ipu/jBGLDd/ZqO0xH3JLPe/1c3jKXkF2mGboV55+px8xKxK9Wd?=
 =?us-ascii?Q?pnz65DZLWycQ7TiZ2WYq10G7N98dhLpUHoDbfqXdSdxRcJ+i7UyuUal20Cej?=
 =?us-ascii?Q?6fZlnmHrUQileCF8fcmyVbVZ5HISpd0dJZi/jUIpqGPf5+tvCBilYs285OBz?=
 =?us-ascii?Q?cPcQiJP4PUUWnkvI/xoT7wqeaZvCK9UuRv10JDhSDYZvqsYir6CR7kr+iS4Z?=
 =?us-ascii?Q?3Ey8zqxQns5p/JpPliOhzJ9barTJ/SJFOu4S+ItbNCZZLau5U/R+ufl7uRUD?=
 =?us-ascii?Q?/AMPYqhOf3oTZbb39gJhqzJHT3Ic5ed84d0bghiCq0bMLFner1hMjAsi9xkP?=
 =?us-ascii?Q?yuWK1bx2NHO5vzYAShhrHGxfmNAt/jdPSSxWO2cGtvYHnfhtxjosux0bW09P?=
 =?us-ascii?Q?IQWLusmNBbmZcNMijjvRAVRA8hbxybW6VqTY25BcylnDyO1DrmXRAzbHR/rM?=
 =?us-ascii?Q?6DXKL3fTk+EWHINty7Cf+1qUaKodwn3pzSUXNEx71TzH+WlgOolX9NYzJA0a?=
 =?us-ascii?Q?sfK8P4jfSBN0tXsgJVaGcE2GwniFWwvnQEmPg7XSh5+8SiFlVCZphY87BI0P?=
 =?us-ascii?Q?d40Uibqbv1T1XRrr+8xHRIsUmXR2vdEBU8JO4LHZKZ5GhFG2WMK8p8iCAIhV?=
 =?us-ascii?Q?HRp6q+hTnHGC/v0lA+DDTwU+3KIZyPFnGK9vWy1w6C80ZB+HCmcWVPKOgf9y?=
 =?us-ascii?Q?zjphxJ3ZKPQulJkEibfNPQT41//MmXpFhefRC+0U4ZFiNOQ1QDLXfJdb9btk?=
 =?us-ascii?Q?zMnsFHChRZXNajfpNmA3uzED6dDRDVBpO0bcx1mJ8aQKJNb9E/4Ro3G1n4M2?=
 =?us-ascii?Q?GZzrzlR9as8mFk+SF9WbwMKh++PnEorEc87xotDoPOhPnlMNDn0EpJTQsfcJ?=
 =?us-ascii?Q?D/KJ3C6tFVzdOBmPDNcQfX0Mt00fFdFz1lbCTnAEEnll6a2BK6i9YihmoV6J?=
 =?us-ascii?Q?hIOwrcq5O5hQtrKpqFxQyOIaf1Omx0ivb9TutpiQ/uRomKl2oH7xiLtFVV/M?=
 =?us-ascii?Q?xdi1DeP2O+ERjclNomCmDW5ayG5WPU00YksVZgBAl6vN+cZ4dPZtr6ZvXgsF?=
 =?us-ascii?Q?RM1r5jG/ulEouvB+kuhZ5NkrPks4N78f1Eby5q1OHFIZPr3cQPgOjD1zEIpj?=
 =?us-ascii?Q?Xg=3D=3D?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b67a5f49-5933-4b59-c0e3-08da8669a7a1
X-MS-Exchange-CrossTenant-AuthSource: MW5PR11MB5764.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2022 07:15:57.0617
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: fvLdHszh166wEtns1+hc7c5PMGRc26kPJ5zOAQ24c8dDT92VwR52WjnXGbSaZySJIEJmi1s6I6pNJPMCyMZeE0MZumBmSmTVOgNUnWUhR0c=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5904
X-Proofpoint-ORIG-GUID: OGltPaKtnAbQ01-Otx_9rQxSq7Y-86NH
X-Proofpoint-GUID: OGltPaKtnAbQ01-Otx_9rQxSq7Y-86NH
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-25_03,2022-08-22_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0
 mlxlogscore=943 priorityscore=1501 clxscore=1011 phishscore=0 bulkscore=0
 suspectscore=0 spamscore=0 lowpriorityscore=0 adultscore=0 impostorscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2207270000 definitions=main-2208250025
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The pfuze_chip::regulator_descs is an array of size
PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators
is the pointer to the real regulators of a specific device.
The number of real regulator is supposed to be less than
the PFUZE100_MAX_REGULATOR, so we should use the size of
'regulator_num * sizeof(struct pfuze_regulator)' in memcpy().
This fixes the out of bounds access bug reported by KASAN.
  BUG: KASAN: global-out-of-bounds in pfuze100_regulator_probe+0x380/0x8b8
  Read of size 3968 at addr c3390640 by task swapper/0/1

  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-yocto-standard+ #2
  Hardware name: Freescale i.MX6 SoloX (Device Tree)
   unwind_backtrace from show_stack+0x18/0x1c
   show_stack from dump_stack_lvl+0x68/0x90
   dump_stack_lvl from print_report+0x58/0x4c8
   print_report from kasan_report+0x7c/0x98
   kasan_report from kasan_check_range+0x20/0x170
   kasan_check_range from memcpy+0x28/0x68
   memcpy from pfuze100_regulator_probe+0x380/0x8b8
   pfuze100_regulator_probe from i2c_device_probe+0x37c/0x39c
   i2c_device_probe from really_probe+0x1cc/0x398
   really_probe from __driver_probe_device+0x118/0x124
   __driver_probe_device from driver_probe_device+0x5c/0xf0
   driver_probe_device from __driver_attach+0x144/0x160
   __driver_attach from bus_for_each_dev+0xf4/0x12c
   bus_for_each_dev from bus_add_driver+0x124/0x264
   bus_add_driver from driver_register+0x130/0x188
   driver_register from i2c_register_driver+0x80/0xa8
   i2c_register_driver from do_one_initcall+0x180/0x39c
   do_one_initcall from kernel_init_freeable+0x374/0x3cc
   kernel_init_freeable from kernel_init+0x1c/0x150
   kernel_init from ret_from_fork+0x14/0x2c
  Exception stack(0xf083bfb0 to 0xf083bff8)
  bfa0:                                     00000000 00000000 00000000
  bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  bfe0: 00000000 00000000 00000000 00000000 00000013 00000000

  The buggy address belongs to the variable:
   pfuze200_regulators+0x0/0xdc0

  The buggy address belongs to the physical page:
  page:(ptrval) refcount:1 mapcount:0 mapping:00000000 index:0x0
  pfn:0x93390
  flags: 0x1000(reserved|zone=0)
  raw: 00001000 ee9a5044 ee9a5044 00000000 00000000 00000000 ffffffff
  raw: 00000000
  page dumped because: kasan: bad access detected

  Memory state around the buggy address:
   c3391280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   c3391300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  >c3391380: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
                                           ^
   c3391400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   c3391480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
---
 drivers/regulator/pfuze100-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 6b617024a67d..d899d6e98fb8 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -766,7 +766,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
 		((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
 
 	memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
-		sizeof(pfuze_chip->regulator_descs));
+		regulator_num * sizeof(struct pfuze_regulator));
 
 	ret = pfuze_parse_regulators_dt(pfuze_chip);
 	if (ret)
-- 
2.25.1