Received-SPF: pass (google.com: domain of linux-kernel+bounces-123151-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <b2c6bc3e-11c5-4a20-8a30-666821ab2613@intel.com>
Date: Thu, 28 Mar 2024 16:27:24 +0100
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] gpio: davinci: Fix potential buffer overflow
To: Aleksandr Mishin <amishin@t-argos.ru>
CC: Keerthy <j-keerthy@ti.com>, Linus Walleij <linus.walleij@linaro.org>,
	Bartosz Golaszewski <brgl@bgdev.pl>, "Andrew F. Davis" <afd@ti.com>,
	<linux-gpio@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<lvc-project@linuxtesting.org>
References: <20240328091021.18027-1-amishin@t-argos.ru>
From: Alexander Lobakin <aleksander.lobakin@intel.com>
Content-Language: en-US
In-Reply-To: <20240328091021.18027-1-amishin@t-argos.ru>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZTlEWWFuRUtXbEVOZzU5M2dXVEV1dHh6ZDZlU3Z3aVlpa01BdHpRVTZkWEZ5?=
 =?utf-8?B?OXVINVh4V0dEZ1hHR25TbUFKTXREY3Zldng0N2dUeS9wMXpmVlZVeVpaZzJv?=
 =?utf-8?B?d24ydzdQNVNwQTVZMW5YbHE3cCtwa0Q0R2wydjdZdVNoWTFPbTlsQTJqQzAw?=
 =?utf-8?B?Z3p6R2UvTUg3SVc3RTdRSjZuNFBkeENyMDBCV3NIWmQ0TFNxNVg2em1oWnNO?=
 =?utf-8?B?WG9QbUJpblBPelZ5ZWZHVlBEL1hIU1BUNkJoOGowQ3Z2Q1NocFoyY1M0RWYw?=
 =?utf-8?B?OGZReTdENWxOdGJiY2VmQWF3NlJFbzBvZjNkY0lrb3BLUFJ4KzhhZi9WM2JT?=
 =?utf-8?B?RHdyZVU0aTdjYjlGTkFSMlNRSGExS2dDa1lYakZ5NG12TzNvb2NBaGJ4L3BQ?=
 =?utf-8?B?RGg0OFVTTERjQnRRdjVXTS9DNHBhOVZ5WHREUXdrdmE4b05oNVFveFhCNGN5?=
 =?utf-8?B?ZVFwaWdjSnlNYlA5QUJaZGVsRWF1cUxtc2V5WFVXVmN6ZlZxdTJIb3dSWXBE?=
 =?utf-8?B?OE10aEUzWWQweVl3TWxZYi9lbmFZdDhIVTREYUM4RzNLMGNJRnh1WW5JcmV3?=
 =?utf-8?B?aDR1VXQvUytFSE91RUgrWjhra1N0amwrU2FjMkpza2hTTmVkZldac2tYeGZl?=
 =?utf-8?B?VmZtWUZJa2lKQitYSzh3NkdKR2VMQ1V3V1A1QWpsd1hneHhRbXQzYWY4SklP?=
 =?utf-8?B?Zkh4elVpRVpkdCtrSXZzZHJuVG9saEZzSDFMQkJBQk1xMzFBSFlURUtEMC9Z?=
 =?utf-8?B?aFN4NFFBTlNXZXNWTGV4bGFzNEFPNVRNQXV0RHlSTk41aS9KMUFZZ29CdDZB?=
 =?utf-8?B?SmljbFVTdEpZTGtEVlpDdjI2WGJzRTRVTnpZQ1E3YklVcEdNeUxjWWZpbnly?=
 =?utf-8?B?dEFVK2hOaXludXJsMXJ4dTU5U0RnUjdlUTJmMUtIOC9uNzluMStEclhSTmRN?=
 =?utf-8?B?YkZLbEo1M3VrSisrZGwxUklSaDBvZnZnRlpsRVFBM3EzZkpOakFMMGI0a3Bv?=
 =?utf-8?B?N1NtQ3ByNEZGR1dJbURZa0w0ZHU0bWpwV1ExQXNWVnl3Y3UxNitObzI3STNZ?=
 =?utf-8?B?RG5BTEllL0FDY29YdmptTndNcjAzbmdNSlpDQTVkZlRxUTBiL0JvLzdGMStT?=
 =?utf-8?B?Qm8xQXU3ajV5TzJqc3JReG4rd0Q2T3lQMkFvQmNwN0psbVhyY1N4a0cvV3dZ?=
 =?utf-8?B?bjM4MGZQZXZPWGE3c3hYZmgwNHJpRVlKOW9uK0ZjaTJOTjI3TmE1VEpiZnpq?=
 =?utf-8?B?RVc3bFZvUWlUdis4bjVMVVN3N2hpOW5SZGFreThRQXpiL3J6Z3VVclJQdVVu?=
 =?utf-8?B?UW5zd0N1NllPb25Oa0xXSnlpL0o1a1pjRE1WeVVBazloNDB4cEhnMDBEV2Fr?=
 =?utf-8?B?WXlHQSs1NW1zT0Q0WmhWaU9DWk84a2RxQ2pONkJndXpRWGdXUEFFdDRrTjMx?=
 =?utf-8?B?TXllbkpCeXJYVE5PR1JlNXFqUTRKZXBCeDhxU05tV2xvdjlEdUJUbFByeXBq?=
 =?utf-8?B?R1FZd2xnZXlQVmlYb2tzaldPYUFJZk9pQWh3YjdWZVpUM3FEdUJ4Qnh1TUhB?=
 =?utf-8?B?NjBYVXV0eUpKWDFRbHRmNkUwRkFzMDhFRVNINnFhYkxQbEViWm5aNkhYdFhv?=
 =?utf-8?B?ZDROcDhOaCtFWnBJMG9DeitZbEhJUWhiblhYNTU3ekYvb1kwSnk4WFdwdmRh?=
 =?utf-8?B?b1JZZW1GaElYRjQ0YTVZbFRBR3pUb2VlRzFBZzA0MlZxS1VXRjNPY1Y0dkQ5?=
 =?utf-8?B?anFYeDc4c2xRbnhBVUVHTlpkY1lLemJSNUtQVGtuL2JwQmZuYTlRakhuVWx2?=
 =?utf-8?B?eUtwcDMzdXEwcmNCdDIzdzNSamxSQStZOXJkZnh0d05wbzBLa2MyenJSbkhK?=
 =?utf-8?B?OEtEVWdmbTVudk44VnN5TDFySlhHbWUvMThvM3NzanNEU0I2bVNid3lHQ1VQ?=
 =?utf-8?B?NlYyUGJZYkVKT242cWQ0eENlNUlOSmVEOFdJS1QrL21LVkU5ZWZaRkNzeEYv?=
 =?utf-8?B?RmhhK0duWHVSMkpzMElzUUplU3puR2FZNHpIY1N6bEZhMWRLVHM1cDZtcFFn?=
 =?utf-8?B?VDhyZm4yMzNvZis5WXB2cDh5ZDh6TkJlZ3d6dGhFMVZFNkJSMDc5d3oxN0NS?=
 =?utf-8?B?QjBoUldoUE9KOGJ0dGtoSm9ZWGlrei9PYy8xT01HSUZGazdMbjViZUk0OVVM?=
 =?utf-8?B?dFE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: d08fa24f-fb98-4596-ff80-08dc4f3b9f2f
X-MS-Exchange-CrossTenant-AuthSource: DS0PR11MB8718.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Mar 2024 15:27:47.4341
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: DnYyqUGxZUmYx6bRtuu5L+MlebeJa/y+IXD2WqjiX0g+hYOnGU+mgWVCBnEiSyiVIzzkZtxHcuYDX4N4ND/ZNwyU7fXeFZnfjpPYrqL8kzc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB8500
X-OriginatorOrg: intel.com

From: Aleksandr Mishin <amishin@t-argos.ru>
Date: Thu, 28 Mar 2024 12:10:21 +0300

> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
> 'bank' can have an out of range value 63.
> Fix this bug by limiting top index value.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: c809e37a3b5a ("gpio: davinci: Allocate the correct amount of memory for controller")
> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
> ---
>  drivers/gpio/gpio-davinci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
> index bb499e362912..b65df1f2b83f 100644
> --- a/drivers/gpio/gpio-davinci.c
> +++ b/drivers/gpio/gpio-davinci.c
> @@ -257,6 +257,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
>  	spin_lock_init(&chips->lock);
>  
>  	nbank = DIV_ROUND_UP(ngpio, 32);
> +    if (nbank > MAX_REGS_BANKS || nbank > 5) {
> +        nbank = MAX_REGS_BANKS < 5 ? MAX_REGS_BANKS : 5;
> +	}

Static analysis warnings make no sense until you provide a reliable way
to trigger the problem on real systems.

>  	for (bank = 0; bank < nbank; bank++)
>  		chips->regs[bank] = gpio_base + offset_array[bank];
>  

Thanks,
Olek