From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A29B7C433FE for ; Thu, 13 Oct 2022 00:36:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232096AbiJMAgk (ORCPT ); Wed, 12 Oct 2022 20:36:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231862AbiJMAdO (ORCPT ); Wed, 12 Oct 2022 20:33:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22C42C7851; Wed, 12 Oct 2022 17:28:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AA9D3B81CF4; Thu, 13 Oct 2022 00:26:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FCE5C433B5; Thu, 13 Oct 2022 00:26:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665620795; bh=8VBt0TV070VIaruyQ4lTpvVLgKOxHaLZWr95D3YRDZk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jAyxA1V919rde29/i8Np0MhZkSfaRBH9/wxTIkuAoKvBcJGsQBgVHEnUr2/VjkMDq losQIEtNV3/a7f602OgtbtAyucUkJz28/bme5k3lTBCU6HjrcQONAAZPiGZRX072+E 554VkHpu/7ICHlstnbuasj9DmCzCgLUE2FO4vwTAQx9I/Wm5XG2RC6g2p+QkyzLzXu QjE8NWqPn+s3/pNSmocJ/inqwa+StGOwD1cE+h+c9VwQ879SUUtMY4qbsMAwvVXYPG 6fih+vgNGoeUSVTlb1jgu7IhD44Ex4dmgAYe7XKC269kpFmjq2QKiQHYSZMO+WS2bG 1C+GbDpbJ6nVA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Serge Semin , Hannes Reinecke , Damien Le Moal , Sasha Levin , hdegoede@redhat.com, axboe@kernel.dk, linux-ide@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 06/19] ata: libahci_platform: Sanity check the DT child nodes number Date: Wed, 12 Oct 2022 20:26:05 -0400 Message-Id: <20221013002623.1895576-6-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221013002623.1895576-1-sashal@kernel.org> References: <20221013002623.1895576-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Serge Semin [ Upstream commit 3c132ea6508b34956e5ed88d04936983ec230601 ] Having greater than AHCI_MAX_PORTS (32) ports detected isn't that critical from the further AHCI-platform initialization point of view since exceeding the ports upper limit will cause allocating more resources than will be used afterwards. But detecting too many child DT-nodes doesn't seem right since it's very unlikely to have it on an ordinary platform. In accordance with the AHCI specification there can't be more than 32 ports implemented at least due to having the CAP.NP field of 5 bits wide and the PI register of dword size. Thus if such situation is found the DTB must have been corrupted and the data read from it shouldn't be reliable. Let's consider that as an erroneous situation and halt further resources allocation. Note it's logically more correct to have the nports set only after the initialization value is checked for being sane. So while at it let's make sure nports is assigned with a correct value. Signed-off-by: Serge Semin Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal Signed-off-by: Sasha Levin --- drivers/ata/libahci_platform.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c index 6a55aac0c60f..63086f90bbf8 100644 --- a/drivers/ata/libahci_platform.c +++ b/drivers/ata/libahci_platform.c @@ -421,14 +421,24 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, } } - hpriv->nports = child_nodes = of_get_child_count(dev->of_node); + /* + * Too many sub-nodes most likely means having something wrong with + * the firmware. + */ + child_nodes = of_get_child_count(dev->of_node); + if (child_nodes > AHCI_MAX_PORTS) { + rc = -EINVAL; + goto err_out; + } /* * If no sub-node was found, we still need to set nports to * one in order to be able to use the * ahci_platform_[en|dis]able_[phys|regulators] functions. */ - if (!child_nodes) + if (child_nodes) + hpriv->nports = child_nodes; + else hpriv->nports = 1; hpriv->phys = devm_kcalloc(dev, hpriv->nports, sizeof(*hpriv->phys), GFP_KERNEL); -- 2.35.1