Re: [PATCH 02/10] pinctrl: nuvoton: ma35: Prevent out-of-bounds write in ma35_pinctrl_get_soc_data()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] pinctrl: nuvoton: use-after-free in ma35_gpiolib_register()
  [1]
--

commit d261fa88956097cc3c05a1bf0a8ef41b4bf318b2
Author: Lee Jones <lee@kernel.org>

pinctrl: nuvoton: ma35: Prevent out-of-bounds write in ma35_pinctrl_get_soc_data()

This commit adds a bounds check on id against ctrl->nr_banks in
ma35_pinctrl_get_soc_data() to prevent writing past the end of
ctrl->pin_banks when the Device Tree contains more than
MA35_GPIO_BANK_MAX GPIO controller child nodes.

> diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> index 16f12cafa9404..4d1203b243c0b 100644
> --- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> +++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> @@ -622,6 +622,12 @@ static int ma35_pinctrl_get_soc_data(struct ma35_pinctrl *pctl, struct platform_
>  	}
>  
>  	for_each_gpiochip_node(&pdev->dev, child) {
> +		if (id >= ctrl->nr_banks) {
> +			dev_err(&pdev->dev, "Exceeded max GPIO banks (%u)\n",
> +				ctrl->nr_banks);
> +			fwnode_handle_put(child);
> +			return -EINVAL;
> +		}
>  		bank = &ctrl->pin_banks[id];
>  		bank->fwnode = child;
>  		bank->regmap = pctl->regmap;

[Severity: Critical]
This problem wasn't introduced by this patch, but does storing child in
bank->fwnode without fwnode_handle_get() leave a dangling pointer
[1]?

for_each_gpiochip_node() drops the reference on each child node as the
iterator advances, so bank->fwnode is left without a reference once the
loop moves on.  Later during probe, ma35_gpiolib_register() passes
bank->fwnode to dev_warn() with "%pfw" if !bank->valid, resulting in a
use-after-free.

[1] https://sashiko.dev/#/bug/linux-f140abe2-145a-4f6b-b626-bbabdc7327c4

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111215256.1982044-1-lee@kernel.org?part=2