Skip to contentSkip to conversation

mfd: mt6360: add bound check in regmap read/write function

PATCH Superseded cy_huang 2 participants 2 messages Sep 14, 2022 – Sep 28, 2022

Subsystems (3)
Stable branch Arm MediaTek Multifunction devices (MFD)

v1 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

cy_huang

author
#0 lore raw

PATCH 1/1 mfd: mt6360: add bound check in regmap read/write function

From: ChiYuan Huang <[email protected]>

Fix the potential risk for null pointer if bank index is over the maximimum.

Refer to the discussion list for the experiment result on mt6370.
https://lore.kernel.org/all/[email protected]/
If not to check the bound, there is the same issue on mt6360.

Fixes 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write)
Cc [email protected]
Signed-off-by ChiYuan Huang <[email protected]>
---
 drivers/mfd/mt6360-core.c | 6 ++++++
 1 file changed, 6 insertions(+)
drivers/mfd/mt6360-core.c +6 -0
index 6eaa677..d375333 100644
@@ -410,6 +410,9 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size,
 	u8 crc;
 	int ret;
 
+	if (bank >= MT6360_SLAVE_MAX)
+		return -EINVAL;
+
 	if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
 		crc_needed = true;
 		ret = mt6360_xlate_pmicldo_addr(&reg_addr, val_size);

@@ -460,6 +463,9 @@ static int mt6360_regmap_write(void *context, const void *val, size_t val_size)
 	int write_size = val_size - MT6360_REGMAP_REG_BYTE_SIZE;
 	int ret;
 
+	if (bank >= MT6360_SLAVE_MAX)
+		return -EINVAL;
+
 	if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
 		crc_needed = true;
 		ret = mt6360_xlate_pmicldo_addr(&reg_addr, val_size - MT6360_REGMAP_REG_BYTE_SIZE);
Signature · 1 line
2.7.4
maintainer
#1 lore raw
Quoted 20 lines · cy_huang

From: ChiYuan Huang <[email protected]>

Fix the potential risk for null pointer if bank index is over the maximimum.

Refer to the discussion list for the experiment result on mt6370.
https://lore.kernel.org/all/[email protected]/
If not to check the bound, there is the same issue on mt6360.

Fixes 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write)
Cc [email protected]
Signed-off-by ChiYuan Huang <[email protected]>
---
 drivers/mfd/mt6360-core.c | 6 ++++++
 1 file changed, 6 insertions(+)
drivers/mfd/mt6360-core.c +0 -0
index 6eaa677..d375333 100644

drivers/mfd/mt6360-core.c static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size, · line 415

Quoted 6 lines
drivers/mfd/mt6360-core.c +3 -0
@@ -410,6 +410,9 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size,
 	u8 crc;
 	int ret;
 
+	if (bank >= MT6360_SLAVE_MAX)
+		return -EINVAL;
+

It's too late to check bank's value here, we have already used it to index into an array by this point. Please fix that.

Quoted 13 lines
drivers/mfd/mt6360-core.c +3 -0
 	if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
 		crc_needed = true;
 		ret = mt6360_xlate_pmicldo_addr(&reg_addr, val_size);

@@ -460,6 +463,9 @@ static int mt6360_regmap_write(void *context, const void *val, size_t val_size)
 	int write_size = val_size - MT6360_REGMAP_REG_BYTE_SIZE;
 	int ret;
 
+	if (bank >= MT6360_SLAVE_MAX)
+		return -EINVAL;
+
 	if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) {
 		crc_needed = true;
 		ret = mt6360_xlate_pmicldo_addr(&reg_addr, val_size - MT6360_REGMAP_REG_BYTE_SIZE);
Signature · 1 line
Lee Jones [李琼斯]