Received-SPF: pass (google.com: domain of linux-kernel+bounces-122778-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 28 Mar 2024 13:32:33 +0300
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Aleksandr Mishin <amishin@t-argos.ru>
Cc: Keerthy <j-keerthy@ti.com>, Linus Walleij <linus.walleij@linaro.org>,
	Bartosz Golaszewski <brgl@bgdev.pl>, "Andrew F. Davis" <afd@ti.com>,
	linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org,
	lvc-project@linuxtesting.org
Subject: Re: [PATCH] gpio: davinci: Fix potential buffer overflow
Message-ID: <014637ee-6d5e-41f9-abb6-d9c56ac5bf32@moroto.mountain>
References: <20240328091021.18027-1-amishin@t-argos.ru>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240328091021.18027-1-amishin@t-argos.ru>

On Thu, Mar 28, 2024 at 12:10:21PM +0300, Aleksandr Mishin wrote:
> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
> 'bank' can have an out of range value 63.
                                        ^^

Where does this 63 come from?  SVACE is a static analysis tool.  I would
have thought a static checker would say that 'bank' goes up to
UINT_MAX / 32.

This stuff comes from device tree though, so it looks fine to me.

Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <144>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <32>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <56>;
arch/arm/boot/dts/ti/davinci/da850.dtsi:                        ti,ngpio = <144>;

So it's fine.

I'm not the maintainer of this file so I don't know if adding a sanity
check makes sense but if we wanted to do that we'd have to add it to
davinci_gpio_get_pdata().  Otherwise it would have already had a buffer
overflow earlier in the probe function when we do:

drivers/gpio/gpio-davinci.c
   223          if (pdata->gpio_unbanked)
   224                  nirq = pdata->gpio_unbanked;
   225          else
   226                  nirq = DIV_ROUND_UP(ngpio, 16);
   227  
   228          chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL);
   229          if (!chips)
   230                  return -ENOMEM;
   231  
   232          gpio_base = devm_platform_ioremap_resource(pdev, 0);
   233          if (IS_ERR(gpio_base))
   234                  return PTR_ERR(gpio_base);
   235  
   236          for (i = 0; i < nirq; i++) {
   237                  chips->irqs[i] = platform_get_irq(pdev, i);
                                   ^^^

   238                  if (chips->irqs[i] < 0)
   239                          return chips->irqs[i];
   240          }

regards,
dan carpenter