From: Johan Hovold <johan@kernel.org>
To: Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>, Sven Peter <sven@kernel.org>,
Janne Grunau <j@jannau.net>,
Rob Clark <robin.clark@oss.qualcomm.com>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Yong Wu <yong.wu@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Chen-Yu Tsai <wens@csie.org>,
Thierry Reding <thierry.reding@gmail.com>,
Krishna Reddy <vdumpa@nvidia.com>,
iommu@lists.linux.dev, linux-kernel@vger.kernel.org,
Johan Hovold <johan@kernel.org>
Subject: [PATCH v3 10/14] iommu/mediatek-v1: add missing larb count sanity check
Date: Mon, 20 Oct 2025 06:53:14 +0200 [thread overview]
Message-ID: <20251020045318.30690-11-johan@kernel.org> (raw)
In-Reply-To: <20251020045318.30690-1-johan@kernel.org>
Add the missing larb count sanity check to avoid writing beyond a fixed
sized array in case of a malformed devicetree.
Acked-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Yong Wu <yong.wu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/iommu/mtk_iommu_v1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 44b965a2db92..55d6615a41a9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -643,6 +643,9 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
if (larb_nr < 0)
return larb_nr;
+ if (larb_nr > MTK_LARB_NR_MAX)
+ return -EINVAL;
+
for (i = 0; i < larb_nr; i++) {
struct device_node *larbnode;
struct platform_device *plarbdev;
--
2.49.1
next prev parent reply other threads:[~2025-10-20 4:56 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-20 4:53 [PATCH v3 00/14] iommu: fix device leaks Johan Hovold
2025-10-20 4:53 ` [PATCH v3 01/14] iommu/apple-dart: fix device leak on of_xlate() Johan Hovold
2025-10-20 4:53 ` [PATCH v3 02/14] iommu/qcom: " Johan Hovold
2025-10-20 4:53 ` [PATCH v3 03/14] iommu/exynos: " Johan Hovold
2025-10-20 4:53 ` [PATCH v3 04/14] iommu/ipmmu-vmsa: " Johan Hovold
2025-10-20 4:53 ` [PATCH v3 05/14] iommu/mediatek: " Johan Hovold
2025-10-20 10:35 ` AngeloGioacchino Del Regno
2025-10-20 4:53 ` [PATCH v3 06/14] iommu/mediatek: fix use-after-free on probe deferral Johan Hovold
2025-10-20 10:35 ` AngeloGioacchino Del Regno
2025-10-25 9:18 ` Yong Wu (吴勇)
2025-10-20 4:53 ` [PATCH v3 07/14] iommu/mediatek: simplify dt parsing error handling Johan Hovold
2025-10-20 10:35 ` AngeloGioacchino Del Regno
2025-10-25 9:18 ` Yong Wu (吴勇)
2025-10-20 4:53 ` [PATCH v3 08/14] iommu/mediatek-v1: fix device leak on probe_device() Johan Hovold
2025-10-20 10:35 ` AngeloGioacchino Del Regno
2025-10-20 4:53 ` [PATCH v3 09/14] iommu/mediatek-v1: fix device leaks on probe() Johan Hovold
2025-10-20 10:35 ` AngeloGioacchino Del Regno
2025-10-20 4:53 ` Johan Hovold [this message]
2025-10-20 10:35 ` [PATCH v3 10/14] iommu/mediatek-v1: add missing larb count sanity check AngeloGioacchino Del Regno
2025-10-20 4:53 ` [PATCH v3 11/14] iommu/omap: fix device leaks on probe_device() Johan Hovold
2025-10-20 4:53 ` [PATCH v3 12/14] iommu/omap: simplify probe_device() error handling Johan Hovold
2025-10-20 4:53 ` [PATCH v3 13/14] iommu/sun50i: fix device leak on of_xlate() Johan Hovold
2025-10-20 4:53 ` [PATCH v3 14/14] iommu/tegra: fix device leak on probe_device() Johan Hovold
2025-11-10 9:14 ` [PATCH v3 00/14] iommu: fix device leaks Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251020045318.30690-11-johan@kernel.org \
--to=johan@kernel.org \
--cc=angelogioacchino.delregno@collabora.com \
--cc=iommu@lists.linux.dev \
--cc=j@jannau.net \
--cc=joro@8bytes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=matthias.bgg@gmail.com \
--cc=robin.clark@oss.qualcomm.com \
--cc=robin.murphy@arm.com \
--cc=sven@kernel.org \
--cc=thierry.reding@gmail.com \
--cc=vdumpa@nvidia.com \
--cc=wens@csie.org \
--cc=will@kernel.org \
--cc=yong.wu@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).