lkml.org 
[lkml]   [2023]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] pinctrl: nuvoton: wpcm450: fix out of bounds write
    On Fri, Aug 25, 2023 at 01:15:28PM +0300, Mikhail Kobuk wrote:
    > Write into 'pctrl->gpio_bank' happens before the check for GPIO index
    > validity, so out of bounds write may happen.

    Good point.

    Reviewed-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>

    Thanks!


    >
    > Found by Linux Verification Center (linuxtesting.org) with SVACE.
    >
    > Fixes: a1d1e0e3d80a ("pinctrl: nuvoton: Add driver for WPCM450")
    > Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
    > Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    > ---
    > drivers/pinctrl/nuvoton/pinctrl-wpcm450.c | 6 +++---
    > 1 file changed, 3 insertions(+), 3 deletions(-)
    >
    > diff --git a/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c b/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c
    > index 2d1c1652cfd9..8a9961ac8712 100644
    > --- a/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c
    > +++ b/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c
    > @@ -1062,13 +1062,13 @@ static int wpcm450_gpio_register(struct platform_device *pdev,
    > if (ret < 0)
    > return ret;
    >
    > - gpio = &pctrl->gpio_bank[reg];
    > - gpio->pctrl = pctrl;
    > -
    > if (reg >= WPCM450_NUM_BANKS)
    > return dev_err_probe(dev, -EINVAL,
    > "GPIO index %d out of range!\n", reg);
    >
    > + gpio = &pctrl->gpio_bank[reg];
    > + gpio->pctrl = pctrl;
    > +
    > bank = &wpcm450_banks[reg];
    > gpio->bank = bank;
    >
    > --
    > 2.42.0
    >
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2023-08-27 20:48    [W:7.385 / U:0.848 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site