From 633debe8517ac3593c1f88bb79d58825f933f1e7 Mon Sep 17 00:00:00 2001 From: Aleksandr Mishin Date: Fri, 2 Aug 2024 03:47:44 +0000 Subject: [PATCH] gpio: davinci: Validate the obtained number of IRQs mainline inclusion from mainline-v6.10-rc6 commit 7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP8 CVE: CVE-2024-42092 Reference: http://hulk.rnd.huawei.com/patch/detail/7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164 -------------------------------- Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davinci_gpio_probe(). Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Signed-off-by: Aleksandr Mishin Link: https://lore.kernel.org/r/20240618144344.16943-1-amishin@t-argos.ru Signed-off-by: Bartosz Golaszewski Signed-off-by: He Yujie --- drivers/gpio/gpio-davinci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c index 80597e90de9c..33623bcfc886 100644 --- a/drivers/gpio/gpio-davinci.c +++ b/drivers/gpio/gpio-davinci.c @@ -227,6 +227,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) else nirq = DIV_ROUND_UP(ngpio, 16); + if (nirq > MAX_INT_PER_BANK) { + dev_err(dev, "Too many IRQs!\n"); + return -EINVAL; + } + chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); if (!chips) return -ENOMEM; -- Gitee