From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EEE4C32771 for ; Wed, 28 Sep 2022 10:30:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233343AbiI1Kaj (ORCPT ); Wed, 28 Sep 2022 06:30:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233320AbiI1Kad (ORCPT ); Wed, 28 Sep 2022 06:30:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BFEEEF2F; Wed, 28 Sep 2022 03:30:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 78E3EB82024; Wed, 28 Sep 2022 10:30:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35245C433D6; Wed, 28 Sep 2022 10:30:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1664361030; bh=UzGll+k8wBj+Ek0YtUWqd2Ht46Qd8HsBBj7woBZT0JU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=lriRxLomhxJEbw/wrLv0ke0UK4s3oUWcxVbIfkRMPPJgozbbJHN31fiYiMQ5rEguj XykGCfkNkdlAhUSO3gFICVekG/XhZf4BadVDR5M8xyrU6qJO1n0v5cDggL+7aLEiHC BknJQFhzMN0/4yqywDr8UpQdZhREMSSEBAczEIlEL6COPWlE4hmBtzi4J4WlCI6Vt1 k+s7eW/Itvo0LAKpfYQDrdOvfqmzdW054T1bkAB1yY94JDAqbj+FfRqpmeiTUizFKR uKHJ/FUVKMlkHgNOOtUZXYPwh7SmJh+PfmXIm7NPLs7Oy8pVMmUIFt8SwKrjKkG3o1 jG16SjD1WPHag== Date: Wed, 28 Sep 2022 11:30:24 +0100 From: Lee Jones To: cy_huang Cc: matthias.bgg@gmail.com, gene_chen@richtek.com, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, ChiYuan Huang , stable@vger.kernel.org Subject: Re: [PATCH] mfd: mt6360: add bound check in regmap read/write function Message-ID: References: <1663143973-29254-1-git-send-email-u0084500@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1663143973-29254-1-git-send-email-u0084500@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 14 Sep 2022, cy_huang wrote: > From: ChiYuan Huang > > Fix the potential risk for null pointer if bank index is over the maximimum. > > Refer to the discussion list for the experiment result on mt6370. > https://lore.kernel.org/all/20220914013345.GA5802@cyhuang-hp-elitebook-840-g3.rt/ > If not to check the bound, there is the same issue on mt6360. > > Fixes: 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write) > Cc: stable@vger.kernel.org > Signed-off-by: ChiYuan Huang > --- > drivers/mfd/mt6360-core.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/mfd/mt6360-core.c b/drivers/mfd/mt6360-core.c > index 6eaa677..d375333 100644 > --- a/drivers/mfd/mt6360-core.c > +++ b/drivers/mfd/mt6360-core.c > @@ -410,6 +410,9 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size, > u8 crc; > int ret; > > + if (bank >= MT6360_SLAVE_MAX) > + return -EINVAL; > + It's too late to check bank's value here, we have already used it to index into an array by this point. Please fix that. > if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) { > crc_needed = true; > ret = mt6360_xlate_pmicldo_addr(®_addr, val_size); > @@ -460,6 +463,9 @@ static int mt6360_regmap_write(void *context, const void *val, size_t val_size) > int write_size = val_size - MT6360_REGMAP_REG_BYTE_SIZE; > int ret; > > + if (bank >= MT6360_SLAVE_MAX) > + return -EINVAL; > + > if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) { > crc_needed = true; > ret = mt6360_xlate_pmicldo_addr(®_addr, val_size - MT6360_REGMAP_REG_BYTE_SIZE); -- Lee Jones [李琼斯]