From: Johan Hovold <johan@kernel.org>
To: Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>, Sven Peter <sven@kernel.org>,
Janne Grunau <j@jannau.net>,
Rob Clark <robin.clark@oss.qualcomm.com>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Yong Wu <yong.wu@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Chen-Yu Tsai <wens@csie.org>,
Thierry Reding <thierry.reding@gmail.com>,
Krishna Reddy <vdumpa@nvidia.com>,
iommu@lists.linux.dev, linux-kernel@vger.kernel.org,
Johan Hovold <johan@kernel.org>
Subject: [PATCH 10/14] iommu/mediatek-v1: add missing larb count sanity check
Date: Thu, 25 Sep 2025 14:27:52 +0200 [thread overview]
Message-ID: <20250925122756.10910-11-johan@kernel.org> (raw)
In-Reply-To: <20250925122756.10910-1-johan@kernel.org>
Add the missing larb count sanity check to avoid writing beyond a fixed
sized array in case of a malformed devicetree.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/iommu/mtk_iommu_v1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 44b965a2db92..55d6615a41a9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -643,6 +643,9 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
if (larb_nr < 0)
return larb_nr;
+ if (larb_nr > MTK_LARB_NR_MAX)
+ return -EINVAL;
+
for (i = 0; i < larb_nr; i++) {
struct device_node *larbnode;
struct platform_device *plarbdev;
--
2.49.1
next prev parent reply other threads:[~2025-09-25 12:29 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-25 12:27 [PATCH 00/14] iommu: fix device leaks Johan Hovold
2025-09-25 12:27 ` [PATCH 01/14] iommu/apple-dart: fix device leak on of_xlate() Johan Hovold
2025-09-25 12:27 ` [PATCH 02/14] iommu/qcom: " Johan Hovold
2025-09-25 12:27 ` [PATCH 03/14] iommu/exynos: " Johan Hovold
2025-09-25 12:27 ` [PATCH 04/14] iommu/ipmmu-vmsa: " Johan Hovold
2025-09-25 12:27 ` [PATCH 05/14] iommu/mediatek: " Johan Hovold
2025-09-25 12:27 ` [PATCH 06/14] iommu/mediatek: fix device leaks on probe() Johan Hovold
2025-09-25 12:27 ` [PATCH 07/14] iommu/mediatek: simplify dt parsing error handling Johan Hovold
2025-09-25 12:27 ` [PATCH 08/14] iommu/mediatek-v1: fix device leak on probe_device() Johan Hovold
2025-09-25 12:27 ` [PATCH 09/14] iommu/mediatek-v1: fix device leaks on probe() Johan Hovold
2025-09-25 12:27 ` Johan Hovold [this message]
2025-09-25 12:27 ` [PATCH 11/14] iommu/omap: fix device leaks on probe_device() Johan Hovold
2025-10-02 12:05 ` Robin Murphy
2025-10-02 14:45 ` Johan Hovold
2025-09-25 12:27 ` [PATCH 12/14] iommu/omap: simplify probe_device() error handling Johan Hovold
2025-09-25 12:27 ` [PATCH 13/14] iommu/sun50i: fix device leak on of_xlate() Johan Hovold
2025-09-25 12:27 ` [PATCH 14/14] iommu/tegra: fix device leak on probe_device() Johan Hovold
2025-09-30 18:21 ` [PATCH 00/14] iommu: fix device leaks Jason Gunthorpe
2025-09-30 19:35 ` Robin Murphy
2025-10-01 15:58 ` Jason Gunthorpe
2025-10-02 11:48 ` Robin Murphy
2025-10-02 13:01 ` Jason Gunthorpe
2025-10-01 9:16 ` Johan Hovold
2025-10-01 16:01 ` Jason Gunthorpe
2025-10-07 9:41 ` Johan Hovold
2025-10-02 12:17 ` Robin Murphy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250925122756.10910-11-johan@kernel.org \
--to=johan@kernel.org \
--cc=angelogioacchino.delregno@collabora.com \
--cc=iommu@lists.linux.dev \
--cc=j@jannau.net \
--cc=joro@8bytes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=matthias.bgg@gmail.com \
--cc=robin.clark@oss.qualcomm.com \
--cc=robin.murphy@arm.com \
--cc=sven@kernel.org \
--cc=thierry.reding@gmail.com \
--cc=vdumpa@nvidia.com \
--cc=wens@csie.org \
--cc=will@kernel.org \
--cc=yong.wu@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).