[PATCH] hwmon: (aspeed-g6-pwm-tach) Validate the number of tach channels

[Guenter Roeck <linux@roeck-us.net>]

Sashiko reports:

In aspeed_create_fan_monitor(), the driver reads raw channel numbers:
ret = of_property_read_u8_array(child, "tach-ch", tach_ch, count);
Then in aspeed_present_fan_tach(), it uses the unvalidated channel value
to index into the statically-sized tach_present array:
priv->tach_present[ch] = true;
It also uses the unvalidated channel value to calculate MMIO offsets:
val = readl(priv->base + TACH_ASPEED_CTRL(ch));
If the device tree provides a channel number that exceeds the maximum
allowed channels, could this corrupt adjacent memory and trigger
out-of-bounds MMIO accesses?

Fix the problem by validating the number of tachometer channels reported
from of_property_count_u8_elems() and return an error if the number of
tachometer channels exceeds the number of supported channels. Also, in
aspeed_present_fan_tach(), validate the actual channel number in
aspeed_present_fan_tach() and return an error if it exceeds the number
of channels supported by the driver.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260629232305.2013406-1-linux%40roeck-us.net
Fixes: 7e1449cd15d10 ("hwmon: (aspeed-g6-pwm-tacho): Support for ASPEED g6 PWM/Fan tach")
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/aspeed-g6-pwm-tach.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/aspeed-g6-pwm-tach.c b/drivers/hwmon/aspeed-g6-pwm-tach.c
index 5d611a8e5269..2cb3f2e1aeb2 100644
--- a/drivers/hwmon/aspeed-g6-pwm-tach.c
+++ b/drivers/hwmon/aspeed-g6-pwm-tach.c
@@ -402,13 +402,16 @@ static const struct hwmon_chip_info aspeed_tach_chip_info = {
 	.info = aspeed_tach_info,
 };
 
-static void aspeed_present_fan_tach(struct aspeed_pwm_tach_data *priv, u8 *tach_ch, int count)
+static int aspeed_present_fan_tach(struct aspeed_pwm_tach_data *priv, u8 *tach_ch, int count)
 {
 	u8 ch, index;
 	u32 val;
 
 	for (index = 0; index < count; index++) {
 		ch = tach_ch[index];
+		if (ch >= TACH_ASPEED_NR_TACHS)
+			return -EINVAL;
+
 		priv->tach_present[ch] = true;
 		priv->tach_divisor = DEFAULT_TACH_DIV;
 
@@ -424,6 +427,7 @@ static void aspeed_present_fan_tach(struct aspeed_pwm_tach_data *priv, u8 *tach_
 
 		aspeed_tach_ch_enable(priv, ch, true);
 	}
+	return 0;
 }
 
 static int aspeed_create_fan_monitor(struct device *dev,
@@ -434,7 +438,7 @@ static int aspeed_create_fan_monitor(struct device *dev,
 	u8 *tach_ch;
 
 	count = of_property_count_u8_elems(child, "tach-ch");
-	if (count < 1)
+	if (count < 1 || count > TACH_ASPEED_NR_TACHS)
 		return -EINVAL;
 	tach_ch = devm_kcalloc(dev, count, sizeof(*tach_ch), GFP_KERNEL);
 	if (!tach_ch)
@@ -443,9 +447,7 @@ static int aspeed_create_fan_monitor(struct device *dev,
 	if (ret)
 		return ret;
 
-	aspeed_present_fan_tach(priv, tach_ch, count);
-
-	return 0;
+	return aspeed_present_fan_tach(priv, tach_ch, count);
 }
 
 static void aspeed_pwm_tach_reset_assert(void *data)
-- 
2.45.2