lkml.org 
[lkml]   [2024]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] gpio: davinci: Fix potential buffer overflow
From


28.03.2024 18:27, Alexander Lobakin пишет:
> From: Aleksandr Mishin <amishin@t-argos.ru>
> Date: Thu, 28 Mar 2024 12:10:21 +0300
>
>> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
>> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
>> 'bank' can have an out of range value 63.
>> Fix this bug by limiting top index value.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: c809e37a3b5a ("gpio: davinci: Allocate the correct amount of memory for controller")
>> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
>> ---
>> drivers/gpio/gpio-davinci.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
>> index bb499e362912..b65df1f2b83f 100644
>> --- a/drivers/gpio/gpio-davinci.c
>> +++ b/drivers/gpio/gpio-davinci.c
>> @@ -257,6 +257,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
>> spin_lock_init(&chips->lock);
>>
>> nbank = DIV_ROUND_UP(ngpio, 32);
>> + if (nbank > MAX_REGS_BANKS || nbank > 5) {
>> + nbank = MAX_REGS_BANKS < 5 ? MAX_REGS_BANKS : 5;
>> + }
>
> Static analysis warnings make no sense until you provide a reliable way
> to trigger the problem on real systems.
>
>> for (bank = 0; bank < nbank; bank++)
>> chips->regs[bank] = gpio_base + offset_array[bank];
>>
>
> Thanks,
> Olek
>

I can only see the code at this time. And I see the following:
1. In some configurations CONFIG_ARCH_NR_GPIO value is 2048. So nbank
value can be 64.
2. Previously, a patch was proposed that removes restrictions on the
number of GPIOs
(https://lore.kernel.org/all/cb540a9d73cad36d288664f8b275c6308a4a3168.1662116601.git.christophe.leroy@csgroup.eu/).

--
Kind regards
Aleksandr

\
 
 \ /
  Last update: 2024-03-28 17:28    [W:0.068 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site