From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 307905B216; Fri, 6 Sep 2024 06:42:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725604938; cv=none; b=gj2FgklomAklS9WhfwDT8Ip7WvKoFjtxBHbvHlLSW2dTEOTh0MVPZuM1L5xi9Zo82LIantE7tjZ3HnJQKKgcNjpXC26TKlWClX6ihLuyK70uFUBuZoKXSv+vqp2/aznJezLgdKKb7fBB3rBd/VD1ETwghEwzvahxj7D5myhaunE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725604938; c=relaxed/simple; bh=+IJEH69gOISTWlvg3zPU/w1epIilrKjZbaz5D7bgZs0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=jwqrIQ7nZlV/aR8CnClwrmbmqGDaqm+cUoxiHGYZ+BkSEdWSFgK84w2W4+0ipXKoiOt/u6dHN3GQHk9xixJtrEeC/K6mc/2dXxVk4x29mP5GrlD3dVTRIkDlDMMZpS6GzDRcC1NOlAJX5CJcMXzq0XoLsc+2fWPbnnCOze7tB8Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.com; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-20551e2f1f8so16641915ad.2; Thu, 05 Sep 2024 23:42:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725604936; x=1726209736; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=wLCwuYJ2jIQ7AX7cjzt4YWvFkOdwbanLmpVnFzyu7nI=; b=iOuvb3u5uoZeoVJnvbYH85lisH/zznONCQ9fW+OVEwvag4FnxXz1jZJcCvI38Xslje Wf/BSJovNJegajtBiHnQxciMbUo5b2GwrlWUENAzTRSxEzvqosVAIOWvjzho+qg7ePFR bq48jLqpqjsUw7rPmPJxmzTPwhBiff/h8lA5amy/n+wj8xYu0i4pdZesu2K0kWSHwuEW Fg7Tvykuu0B2Xsft6dBdN0DEnsaakumPsUvoa2NjkW55Q0L0NGyhiXMebwJ7lIfGYb6y wPSoZR+I77kStyoPy50wE0J30WI8wU3sHV/PD+AH1DcK+2CtvsM39KMAfF5JQGaWif5k XGgg== X-Forwarded-Encrypted: i=1; AJvYcCU1MGODuQNET0SwBrhlqO/MdYSgYl22kktdKhJQooL6bAgA9JT5audQoSTEl4akypzg386zDOIxu2MObrk=@vger.kernel.org, AJvYcCXBR5/cfoeJ3ZxoM10tcQv2coFjbOHdx4KUi3uV71Gd2bE2TWdpvZa85fc09SxmhmE+2BXmpiTWkugp@vger.kernel.org X-Gm-Message-State: AOJu0Yw/ZaHzMvFIZoRnOYL0Yda0Tplh8jSZ6tJoFQvB1IHvuXxi2z9Y b8fBfESO6Z90i7Fd1+aQ+eQwoiQY/jKnfH9cwoW68BTm1Q2MBDOD X-Google-Smtp-Source: AGHT+IFhcKxn4gucXi1dxpFusTJmODNkq5R1NnJNsOzTXcINwffJplrx2JVql7aUmLFMrAtY4UvA/g== X-Received: by 2002:a17:903:2409:b0:206:a162:e1bd with SMTP id d9443c01a7336-206f05361e6mr20283585ad.34.1725604936445; Thu, 05 Sep 2024 23:42:16 -0700 (PDT) Received: from localhost (fpd11144dd.ap.nuro.jp. [209.17.68.221]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-206aea38389sm37333465ad.137.2024.09.05.23.42.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Sep 2024 23:42:16 -0700 (PDT) Date: Fri, 6 Sep 2024 15:42:14 +0900 From: Krzysztof =?utf-8?Q?Wilczy=C5=84ski?= To: Alexandra Diupina Cc: Xiaowei Song , Binghui Wang , Lorenzo Pieralisi , Rob Herring , Bjorn Helgaas , Mauro Carvalho Chehab , linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: Re: [PATCH] PCI: kirin: Fix buffer overflow Message-ID: <20240906064214.GC679795@rocinante> References: <20240903115823.30647-1-adiupina@astralinux.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240903115823.30647-1-adiupina@astralinux.ru> Hello, By the way, this would be v2, technically, but not to worry. > In kirin_pcie_parse_port() pcie->num_slots is compared to > pcie->gpio_id_reset size (MAX_PCI_SLOTS). Need to fix > condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move > pcie->num_slots increment lower to avoid out-of-bounds > array access. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. Applied to controller/kirin, thank you! [1/1] PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port() https://git.kernel.org/pci/pci/c/c500a86693a1 Krzysztof