lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 666/849] mtd: rawnand: intel: Fix potential buffer overflow in probe
    Date
    From: Evgeny Novikov <novikov@ispras.ru>

    [ Upstream commit 46a0dc10fb32bec3e765e51bf71fbc070dc77ca3 ]

    ebu_nand_probe() read the value of u32 variable "cs" from the device
    firmware description and used it as the index for array ebu_host->cs
    that can contain MAX_CS (2) elements at most. That could result in
    a buffer overflow and various bad consequences later.

    Fix the potential buffer overflow by restricting values of "cs" with
    MAX_CS in probe.

    Found by Linux Driver Verification project (linuxtesting.org).

    Fixes: 0b1039f016e8 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC")
    Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
    Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
    Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
    Co-developed-by: Anton Vasilyev <vasilyev@ispras.ru>
    Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20210903082653.16441-1-novikov@ispras.ru
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/mtd/nand/raw/intel-nand-controller.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c
    index 29e8a546dcd60..e8476cd5147fe 100644
    --- a/drivers/mtd/nand/raw/intel-nand-controller.c
    +++ b/drivers/mtd/nand/raw/intel-nand-controller.c
    @@ -609,6 +609,11 @@ static int ebu_nand_probe(struct platform_device *pdev)
    dev_err(dev, "failed to get chip select: %d\n", ret);
    return ret;
    }
    + if (cs >= MAX_CS) {
    + dev_err(dev, "got invalid chip select: %d\n", cs);
    + return -EINVAL;
    + }
    +
    ebu_host->cs_num = cs;

    resname = devm_kasprintf(dev, GFP_KERNEL, "nand_cs%d", cs);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 00:14    [W:4.020 / U:0.572 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site