lkml.org 
[lkml]   [2024]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] gpio: davinci: Fix potential buffer overflow
On Thu, Mar 28, 2024 at 12:10:21PM +0300, Aleksandr Mishin wrote:
> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
> 'bank' can have an out of range value 63.
^^

Where does this 63 come from? SVACE is a static analysis tool. I would
have thought a static checker would say that 'bank' goes up to
UINT_MAX / 32.

This stuff comes from device tree though, so it looks fine to me.

Documentation/devicetree/bindings/gpio/gpio-davinci.yaml: ti,ngpio = <144>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml: ti,ngpio = <32>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml: ti,ngpio = <56>;
arch/arm/boot/dts/ti/davinci/da850.dtsi: ti,ngpio = <144>;

So it's fine.

I'm not the maintainer of this file so I don't know if adding a sanity
check makes sense but if we wanted to do that we'd have to add it to
davinci_gpio_get_pdata(). Otherwise it would have already had a buffer
overflow earlier in the probe function when we do:

drivers/gpio/gpio-davinci.c
223 if (pdata->gpio_unbanked)
224 nirq = pdata->gpio_unbanked;
225 else
226 nirq = DIV_ROUND_UP(ngpio, 16);
227
228 chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL);
229 if (!chips)
230 return -ENOMEM;
231
232 gpio_base = devm_platform_ioremap_resource(pdev, 0);
233 if (IS_ERR(gpio_base))
234 return PTR_ERR(gpio_base);
235
236 for (i = 0; i < nirq; i++) {
237 chips->irqs[i] = platform_get_irq(pdev, i);
^^^

238 if (chips->irqs[i] < 0)
239 return chips->irqs[i];
240 }

regards,
dan carpenter


\
 
 \ /
  Last update: 2024-03-28 11:33    [W:0.199 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site