Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Xiaolei Wang <xiaolei.wang@windriver.com>
To:     lgirdwood@gmail.com, broonie@kernel.org
Cc:     linux-kernel@vger.kernel.org
Subject: [v2][PATCH] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
Date:   Thu, 25 Aug 2022 19:19:22 +0800
Message-Id: <20220825111922.1368055-1-xiaolei.wang@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?/i/u2CgNK+eJ4YoNAwhzL4mRxpKPcWHdvUmZsSXBhMbQDhdv348GBbqYA01D?=
 =?us-ascii?Q?6TGq/rGjh0dGAdlNZavydGY7KjXHWqKXYrVSjy5F2jvLMlelZ/J0uhL+GJFe?=
 =?us-ascii?Q?9vPVRllAnluIv1k4WL6njighQPuuZI0uI3EejInPF09c8X/ps3VC/kcCLViX?=
 =?us-ascii?Q?P8o4RyNIS0igEWCNNifKpYgS2asimQtRy00W2jkKq0zdBZnDX04xVmYQikqR?=
 =?us-ascii?Q?aMcOwHg8jYrm+RWSojzxNAdcfP9Sc8sKer7JZpc/Y2dSFh/11MT6/sNR0Ofe?=
 =?us-ascii?Q?/OhwwhrgJY3CdPTlGAWtwiO6KyXux3XTMlK3vhqFcPlYiaAPAQ+VXWgp7D4Y?=
 =?us-ascii?Q?0Wk2JB+jPQ/Bkh4wKepK0C1czz8iwUsb8ZrYVUX0mPTuN7Vd8/olsd+rdTdf?=
 =?us-ascii?Q?mUXGKMvnBKDp0HeCcr8RRhrCJCb0BXTwUaTr7EsjMhNUWaid22dvIajWkv0m?=
 =?us-ascii?Q?iTQWywiO075NJBg3diGAMrmShpPzf6kCtxXMelRx2a8RINKHM1oFBHq2OxQm?=
 =?us-ascii?Q?M97yS1rTVFP+hbFU2EuBA44opWsKvwn4QgzmhbXaiO7GsGfqWoxiN09JYLc7?=
 =?us-ascii?Q?F79B8TwdFGxo6avrQnpBZP5/FXb7GAV7DNyP/7lCg2OBGGxDAgM64JxHBC+o?=
 =?us-ascii?Q?W+Hddsmy0REL9SlQYwiuGHCrlEZNx2PwMOFQXDbLe6neQ68I5Bew16HtTQcj?=
 =?us-ascii?Q?P9e8o0JowOtP6DGdUaN+YXyRykGwkWB4rNkRzVaXL7wuxReH3oEmGKntdZGL?=
 =?us-ascii?Q?cRINteHY2QI3o349nkDug9t0GYhk5HJo9xqF6FgbWvVwhO9irvY/eeSxGFEw?=
 =?us-ascii?Q?NLykCxg5DFQBm3GBnW7w76x72tIcUlh5vIqH2SGOh1z3nVetJLP+OfptdBUZ?=
 =?us-ascii?Q?puOJyIeXp6GMctgGgVu/AmV6uuWzymt5ZbRd4droJc5ommnqxzUG1asucY/T?=
 =?us-ascii?Q?FszeR4gBA1xUWfvkSZWLKkImvNuKKFmcg5i/5bjiTKA3PBXTb+UNWmaiTWOT?=
 =?us-ascii?Q?HghnO/+Q28XjYvZUDrZ87w2y4vG3GcWtFz1+Rz+fvE80r2k0VyDd79GVr6Nk?=
 =?us-ascii?Q?z4WmqRHftI+mdaopX+EW6NoldbpYrS2EA99Ybr/jr7/hwVpyqyVDI073/fmy?=
 =?us-ascii?Q?ngFFXbqA/9cvH74O5kmkM+l9dG4Gmz39eaHb1qYyMHS2hDJJ3tksfGPo9xPZ?=
 =?us-ascii?Q?Zlxi8R4nvKBeLAmlSgl7LpPZ6OEioO+4OohWoDnbc5e+TzMPZgtMYVkcZYcE?=
 =?us-ascii?Q?rxujf6DpfS32rQIhBSvGBoRRkWZzj8qik/RLMj0Va4ZtpRXmyHdwBVpQfc9Z?=
 =?us-ascii?Q?rSQpJuZrl0/xEVcQnWU/UXgRftEnLPGYKclY4WFUnyZMQcXkgNy4/hyoJ5g+?=
 =?us-ascii?Q?+/Gz2q5tYlf/FKLk+J4exDleQ3UfrRR71BkX9J3xnnh2uRFyWhzPBtAsBVkO?=
 =?us-ascii?Q?afbl8Er5Lf7IQkDFPUIeACJBq9trnhLAO4G2KLGeXkB8UcbS7J/HWXVpac6w?=
 =?us-ascii?Q?CGa1pSSfy7ZHESuWwQ/x9ssO65tYrm/LP/uB1lfk8qY3+bkzYl/omtIVOg49?=
 =?us-ascii?Q?8ood385w2DZQ/1P2WVyeIuJRfM+ujujY9vna48YkefcwD19ye8nAbFCNwCKw?=
 =?us-ascii?Q?hA=3D=3D?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3b126d76-269b-4046-4e3b-08da868bb40e
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR11MB5769.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2022 11:19:40.7946
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 82hPZeNDG+6YL80m99MXZNvhY1TZccyMtP+BSPQ/Qt6TsPIYSG2v8ZnrMH1jnHEJUCZV6MwAwz2kIY20oh8s4PfnG5QigL6OnVp/UdWg6jY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB5294
X-Proofpoint-ORIG-GUID: hfaOd71D79PQAXVGc0SDDLWWhQpKM_uF
X-Proofpoint-GUID: hfaOd71D79PQAXVGc0SDDLWWhQpKM_uF
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-25_05,2022-08-25_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0
 mlxlogscore=907 priorityscore=1501 clxscore=1015 phishscore=0 bulkscore=0
 suspectscore=0 spamscore=0 lowpriorityscore=0 adultscore=0 impostorscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2207270000 definitions=main-2208250044
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The pfuze_chip::regulator_descs is an array of size
PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators
is the pointer to the real regulators of a specific device.
The number of real regulator is supposed to be less than
the PFUZE100_MAX_REGULATOR, so we should use the size of
'regulator_num * sizeof(struct pfuze_regulator)' in memcpy().
This fixes the out of bounds access bug reported by KASAN.
  BUG: KASAN: global-out-of-bounds in pfuze100_regulator_probe+0x380/0x8b8
  Read of size 3968 at addr c3390640 by task swapper/0/1

  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-yocto-standard+ #2
  Hardware name: Freescale i.MX6 SoloX (Device Tree)
   unwind_backtrace from show_stack+0x18/0x1c
   show_stack from dump_stack_lvl+0x68/0x90
   dump_stack_lvl from print_report+0x58/0x4c8
   print_report from kasan_report+0x7c/0x98
   kasan_report from kasan_check_range+0x20/0x170
   kasan_check_range from memcpy+0x28/0x68
   memcpy from pfuze100_regulator_probe+0x380/0x8b8
   pfuze100_regulator_probe from i2c_device_probe+0x37c/0x39c
   i2c_device_probe from really_probe+0x1cc/0x398
   really_probe from __driver_probe_device+0x118/0x124
   __driver_probe_device from driver_probe_device+0x5c/0xf0
   driver_probe_device from __driver_attach+0x144/0x160
   __driver_attach from bus_for_each_dev+0xf4/0x12c
   bus_for_each_dev from bus_add_driver+0x124/0x264
   bus_add_driver from driver_register+0x130/0x188
   driver_register from i2c_register_driver+0x80/0xa8
   i2c_register_driver from do_one_initcall+0x180/0x39c
   do_one_initcall from kernel_init_freeable+0x374/0x3cc
   kernel_init_freeable from kernel_init+0x1c/0x150
   kernel_init from ret_from_fork+0x14/0x2c

Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
---
 drivers/regulator/pfuze100-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 6b617024a67d..d899d6e98fb8 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -766,7 +766,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
 		((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
 
 	memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
-		sizeof(pfuze_chip->regulator_descs));
+		regulator_num * sizeof(struct pfuze_regulator));
 
 	ret = pfuze_parse_regulators_dt(pfuze_chip);
 	if (ret)
-- 
2.25.1