From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 88B68C433EF for ; Wed, 11 May 2022 06:50:16 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 3D9AE404F0; Wed, 11 May 2022 06:50:16 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i_rQKuXvA5B9; Wed, 11 May 2022 06:50:15 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [IPv6:2605:bc80:3010:104::8cd3:938]) by smtp2.osuosl.org (Postfix) with ESMTPS id 15C034011F; Wed, 11 May 2022 06:50:15 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id F3A26C0032; Wed, 11 May 2022 06:50:14 +0000 (UTC) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 9BEF8C002D for ; Wed, 11 May 2022 06:50:13 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 8A1C682433 for ; Wed, 11 May 2022 06:50:13 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E-7Q6jACsoeV for ; Wed, 11 May 2022 06:50:13 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by smtp1.osuosl.org (Postfix) with ESMTPS id C507582422 for ; Wed, 11 May 2022 06:50:12 +0000 (UTC) X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4, REQID:1f226f53-b785-49b6-bb50-1eb413231f61, OB:0, LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9, CLOUDID:23eb63b3-56b5-4c9e-8d83-0070b288eb6a, C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 Received: from mtkmbs10n2.mediatek.inc [(172.21.101.183)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1948481888; Wed, 11 May 2022 14:50:05 +0800 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.3; Wed, 11 May 2022 14:50:04 +0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 To: Joerg Roedel , Will Deacon , "Matthias Brugger" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek, larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N Cc: anan.sun@mediatek.com, chengci.xu@mediatek.com, xueqi.zhang@mediatek.com, linux-kernel@vger.kernel.org, libo.kang@mediatek.com, yf.wang@mediatek.com, iommu@lists.linux-foundation.org, linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org, Guenter Roeck , Dan Carpenter , mingyuan.ma@mediatek.com, AngeloGioacchino Del Regno X-BeenThere: iommu@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development issues for Linux IOMMU support List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Yong Wu via iommu Reply-To: Yong Wu Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: iommu-bounces@lists.linux-foundation.org Sender: "iommu" From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m larb_nr = of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NULL); if (larb_nr < 0) return larb_nr; + if (larb_nr == 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; for (i = 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id = i; + if (id >= MTK_LARB_NR_MAX) { + ret = -EINVAL; + goto err_larbnode_put; + } plarbdev = of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret = -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev = &plarbdev->dev; component_match_add_release(dev, match, component_release_of, -- 2.18.0 _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C6D4EC433F5 for ; Wed, 11 May 2022 06:51:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=hikg063hZP/uIL8myzIh3Wla+994zHncknBA/G5y/iw=; b=VtwXwzqs8eAbnX /bEF2nqiuIUPOxvDGTDDCYerh+Wwi94BFwZQ1bR1oWtV4Mk3vwA1ekxP0oPmfxsSw1EiHB6ugdu/w J7iZDJiRNlx5JEHh6vmkKxXR3VUEu4g1F7r92gIIE95f+ZT6CfaWvtkk0R4cHUPjd/npmGCi8cxLV Vvzcfc6F6fWN50Ms+Ntlyr1Q0i3FL9XtgfzNFlldxQaCEf3JG72GWRrEozoJtt848oHBWgWF7hP2X S35LqrB/dzBrPVWBIJcFe0dotRIvYjVHyYdvMWGiiRisEwne0OMNmP9ZsdbjPYINumccuvW3QctVg KDEoqd6Y4upd5U1hzJdg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBZ-005Z4I-U0; Wed, 11 May 2022 06:51:01 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBW-005Z0x-Ik; Wed, 11 May 2022 06:50:59 +0000 X-UUID: 211d69203519445b895dd84258510fed-20220510 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4, REQID:b18fe6dd-be20-496b-88c3-9c92e1c9e7ae, OB:0, LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9, CLOUDID:abf363b3-56b5-4c9e-8d83-0070b288eb6a, C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 211d69203519445b895dd84258510fed-20220510 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1134001176; Tue, 10 May 2022 23:50:49 -0700 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 10 May 2022 23:50:05 -0700 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 From: Yong Wu To: Joerg Roedel , Will Deacon , "Matthias Brugger" CC: , , , , "Yong Wu" , AngeloGioacchino Del Regno , , , , , , , , Guenter Roeck , "Dan Carpenter" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek, larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220510_235058_653329_270C77DB X-CRM114-Status: GOOD ( 16.04 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m larb_nr = of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NULL); if (larb_nr < 0) return larb_nr; + if (larb_nr == 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; for (i = 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id = i; + if (id >= MTK_LARB_NR_MAX) { + ret = -EINVAL; + goto err_larbnode_put; + } plarbdev = of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret = -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev = &plarbdev->dev; component_match_add_release(dev, match, component_release_of, -- 2.18.0 _______________________________________________ Linux-mediatek mailing list Linux-mediatek@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-mediatek From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F0AD0C433F5 for ; Wed, 11 May 2022 06:52:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=JF9Jf+hQ6bG/3rKCmNJKPwOECSXkHGgxTgq2lknUxBE=; b=KHy6wjiPR7wvus CK105VxrGYRRZgxtC2+h1JPZX+pccRV9w2cQcc/RSf0ZwVSUfULLwA2JgTj7DsnDhIb65IomJMeKC htnk4zKTwWFSVepHmlZHalcPd6jAlUP0B4AkMTDwERLFUmr1TeGFRjVwoP/BhLEoYB5QGsFb6xRKS 3AYh+mVs9gW8ql1DKxyo4Ouvb57XRHBOTQXcsrS/Icg3gwdeUAzzoc29RdddXfLoLFipV704Nm9bx RrUU+oPFSLz+ZoxKtoF3eRL09fwR2aed7MLyptiI7RuXLNXJGg1vuRcEp61wqzjuZfcO+Nzy/tX4F JtI+ByM79D7Eicq7CMng==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBc-005Z5C-H0; Wed, 11 May 2022 06:51:04 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBW-005Z0x-Ik; Wed, 11 May 2022 06:50:59 +0000 X-UUID: 211d69203519445b895dd84258510fed-20220510 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4, REQID:b18fe6dd-be20-496b-88c3-9c92e1c9e7ae, OB:0, LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9, CLOUDID:abf363b3-56b5-4c9e-8d83-0070b288eb6a, C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 211d69203519445b895dd84258510fed-20220510 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1134001176; Tue, 10 May 2022 23:50:49 -0700 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 10 May 2022 23:50:05 -0700 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 From: Yong Wu To: Joerg Roedel , Will Deacon , "Matthias Brugger" CC: , , , , "Yong Wu" , AngeloGioacchino Del Regno , , , , , , , , Guenter Roeck , "Dan Carpenter" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek, larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220510_235058_653329_270C77DB X-CRM114-Status: GOOD ( 16.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m larb_nr = of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NULL); if (larb_nr < 0) return larb_nr; + if (larb_nr == 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; for (i = 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id = i; + if (id >= MTK_LARB_NR_MAX) { + ret = -EINVAL; + goto err_larbnode_put; + } plarbdev = of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret = -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev = &plarbdev->dev; component_match_add_release(dev, match, component_release_of, -- 2.18.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A82C7C433F5 for ; Wed, 11 May 2022 06:50:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242388AbiEKGuW (ORCPT ); Wed, 11 May 2022 02:50:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235515AbiEKGuN (ORCPT ); Wed, 11 May 2022 02:50:13 -0400 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66B865D190 for ; Tue, 10 May 2022 23:50:12 -0700 (PDT) X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4,REQID:1f226f53-b785-49b6-bb50-1eb413231f61,OB:0,LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9,CLOUDID:23eb63b3-56b5-4c9e-8d83-0070b288eb6a,C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 Received: from mtkmbs10n2.mediatek.inc [(172.21.101.183)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1948481888; Wed, 11 May 2022 14:50:05 +0800 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.3; Wed, 11 May 2022 14:50:04 +0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 From: Yong Wu To: Joerg Roedel , Will Deacon , "Matthias Brugger" CC: , , , , "Yong Wu" , AngeloGioacchino Del Regno , , , , , , , , Guenter Roeck , "Dan Carpenter" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek,larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m larb_nr = of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NULL); if (larb_nr < 0) return larb_nr; + if (larb_nr == 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; for (i = 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id = i; + if (id >= MTK_LARB_NR_MAX) { + ret = -EINVAL; + goto err_larbnode_put; + } plarbdev = of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret = -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev = &plarbdev->dev; component_match_add_release(dev, match, component_release_of, -- 2.18.0