From: Aleksandr Mishin amishin@t-argos.ru
mainline inclusion from mainline-v6.10-rc6 commit 7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP8 CVE: CVE-2024-42092
Reference: http://hulk.rnd.huawei.com/patch/detail/7aa9b96e9a73e4ec1771492d0527bd5fc5ef...
--------------------------------
Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davinci_gpio_probe().
Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Signed-off-by: Aleksandr Mishin amishin@t-argos.ru Link: https://lore.kernel.org/r/20240618144344.16943-1-amishin@t-argos.ru Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Signed-off-by: He Yujie coka.heyujie@huawei.com --- drivers/gpio/gpio-davinci.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c index abb332d15a13..b77e1c6b099e 100644 --- a/drivers/gpio/gpio-davinci.c +++ b/drivers/gpio/gpio-davinci.c @@ -207,6 +207,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) else nirq = DIV_ROUND_UP(ngpio, 16);
+ if (nirq > MAX_INT_PER_BANK) { + dev_err(dev, "Too many IRQs!\n"); + return -EINVAL; + } + nbank = DIV_ROUND_UP(ngpio, 32); chips = devm_kcalloc(dev, nbank, sizeof(struct davinci_gpio_controller),