From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CDB3C04FE2 for ; Mon, 24 Jul 2023 01:28:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231386AbjGXB22 (ORCPT ); Sun, 23 Jul 2023 21:28:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231684AbjGXB2F (ORCPT ); Sun, 23 Jul 2023 21:28:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C6C7249C7; Sun, 23 Jul 2023 18:25:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C2D8F60EF9; Mon, 24 Jul 2023 01:24:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1015AC433C8; Mon, 24 Jul 2023 01:24:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690161868; bh=nB9sY8X/582vVWL2LbmgPFirUzquFq34/rstMIeanBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QWZ6Sa56GIM6ggUgzJNm2e1v9LynMpjOCG3uIxU33Pirf5wDWkVPpXKq4OME7XKts JbqXnU1Q3sq8dmbQFx8REbMY9/RzZOY9pA1YuDSyItDQrjb7M1I7MpfLuNu0V+W8nR ZnUlIPi+KXFPmO5pPrYLYvfnqh3GAVVRsFQi4TNvx0P95e9nRlIPoY1hnQD89yan2x M2W4GFrwVJzASz70NOYf6i8OTjgCz7YbVTclYSjYJXMFan3+QJxwMKMCBw/f+9ORVe 85tngEgdm3CFGlwOd3QHNv8bI/WHXNFFxCGpo/B95nqNe9pvEPU1EfRflFd9/GKjqf a1a06JMkYxkMA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sumit Gupta , Bjorn Helgaas , Lorenzo Pieralisi , Thierry Reding , Sasha Levin , bhelgaas@google.com, thierry.reding@gmail.com, jonathanh@nvidia.com, linux-pci@vger.kernel.org, linux-tegra@vger.kernel.org Subject: [PATCH AUTOSEL 5.10 05/22] PCI: tegra194: Fix possible array out of bounds access Date: Sun, 23 Jul 2023 21:24:02 -0400 Message-Id: <20230724012419.2317649-5-sashal@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230724012419.2317649-1-sashal@kernel.org> References: <20230724012419.2317649-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.10.186 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org From: Sumit Gupta [ Upstream commit 205b3d02d57ce6dce96f6d2b9c230f56a9bf9817 ] Add check to fix the possible array out of bounds violation by making speed equal to GEN1_CORE_CLK_FREQ when its value is more than the size of "pcie_gen_freq" array. This array has size of four but possible speed (CLS) values are from "0 to 0xF". So, "speed - 1" values are "-1 to 0xE". Suggested-by: Bjorn Helgaas Signed-off-by: Sumit Gupta Link: https://lore.kernel.org/lkml/72b9168b-d4d6-4312-32ea-69358df2f2d0@nvidia.com/ Acked-by: Lorenzo Pieralisi Signed-off-by: Thierry Reding Signed-off-by: Sasha Levin --- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c index 1222f5749bc67..a215777df96c7 100644 --- a/drivers/pci/controller/dwc/pcie-tegra194.c +++ b/drivers/pci/controller/dwc/pcie-tegra194.c @@ -239,6 +239,7 @@ #define EP_STATE_ENABLED 1 static const unsigned int pcie_gen_freq[] = { + GEN1_CORE_CLK_FREQ, /* PCI_EXP_LNKSTA_CLS == 0; undefined */ GEN1_CORE_CLK_FREQ, GEN2_CORE_CLK_FREQ, GEN3_CORE_CLK_FREQ, @@ -470,7 +471,11 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg) speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) & PCI_EXP_LNKSTA_CLS; - clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]); + + if (speed >= ARRAY_SIZE(pcie_gen_freq)) + speed = 0; + + clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]); /* If EP doesn't advertise L1SS, just return */ val = dw_pcie_readl_dbi(pci, pcie->cfg_link_cap_l1sub); @@ -973,7 +978,11 @@ static int tegra_pcie_dw_host_init(struct pcie_port *pp) speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) & PCI_EXP_LNKSTA_CLS; - clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]); + + if (speed >= ARRAY_SIZE(pcie_gen_freq)) + speed = 0; + + clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]); tegra_pcie_enable_interrupts(pp); -- 2.39.2