linux-kernel - [PATCH 1/2] irqchip/qcom-pdc: don't read version register if it is not available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230825213552.1646321-1-dmitry.baryshkov@linaro.org>
Date:   Sat, 26 Aug 2023 00:35:51 +0300
From:   Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To:     Andy Gross <agross@...nel.org>,
        Bjorn Andersson <andersson@...nel.org>,
        Konrad Dybcio <konrad.dybcio@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Marc Zyngier <maz@...nel.org>
Cc:     linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Neil Armstrong <neil.armstrong@...aro.org>
Subject: [PATCH 1/2] irqchip/qcom-pdc: don't read version register if it is not available

On Qualcomm SM8150 the PDC resource has size 0x400. When PDC driver
tries to read the version register (0x1000), it reads past the end of
this resource, causing kernel crash.

Check the size of PDC resource before reading the PDC_VERSION register.

Fixes: bc82cc42644b ("irqchip/qcom-pdc: Add support for v3.2 HW")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
---
 drivers/irqchip/qcom-pdc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
index 9bb6951257c2..431b213b5abb 100644
--- a/drivers/irqchip/qcom-pdc.c
+++ b/drivers/irqchip/qcom-pdc.c
@@ -324,6 +324,7 @@ static int pdc_setup_pin_mapping(struct device_node *np)
 static int qcom_pdc_init(struct device_node *node, struct device_node *parent)
 {
 	struct irq_domain *parent_domain, *pdc_domain;
+	struct resource res;
 	int ret;
 
 	pdc_base = of_iomap(node, 0);
@@ -332,7 +333,14 @@ static int qcom_pdc_init(struct device_node *node, struct device_node *parent)
 		return -ENXIO;
 	}
 
-	pdc_version = pdc_reg_read(PDC_VERSION, 0);
+	if (of_address_to_resource(node, 0, &res))
+		return -EINVAL;
+
+	/* compat with old sm8150 DT which had very small region for PDC */
+	if (resource_size(&res) > PDC_VERSION)
+		pdc_version = pdc_reg_read(PDC_VERSION, 0);
+	else
+		pdc_version = 0;
 
 	parent_domain = irq_find_host(parent);
 	if (!parent_domain) {
-- 
2.39.2