linux-kernel - Re: [PATCH] gpio: davinci: Fix potential buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <014637ee-6d5e-41f9-abb6-d9c56ac5bf32@moroto.mountain>
Date: Thu, 28 Mar 2024 13:32:33 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Aleksandr Mishin <amishin@...rgos.ru>
Cc: Keerthy <j-keerthy@...com>, Linus Walleij <linus.walleij@...aro.org>,
	Bartosz Golaszewski <brgl@...ev.pl>, "Andrew F. Davis" <afd@...com>,
	linux-gpio@...r.kernel.org, linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: Re: [PATCH] gpio: davinci: Fix potential buffer overflow

On Thu, Mar 28, 2024 at 12:10:21PM +0300, Aleksandr Mishin wrote:
> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
> 'bank' can have an out of range value 63.
                                        ^^

Where does this 63 come from?  SVACE is a static analysis tool.  I would
have thought a static checker would say that 'bank' goes up to
UINT_MAX / 32.

This stuff comes from device tree though, so it looks fine to me.

Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <144>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <32>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <56>;
arch/arm/boot/dts/ti/davinci/da850.dtsi:                        ti,ngpio = <144>;

So it's fine.

I'm not the maintainer of this file so I don't know if adding a sanity
check makes sense but if we wanted to do that we'd have to add it to
davinci_gpio_get_pdata().  Otherwise it would have already had a buffer
overflow earlier in the probe function when we do:

drivers/gpio/gpio-davinci.c
   223          if (pdata->gpio_unbanked)
   224                  nirq = pdata->gpio_unbanked;
   225          else
   226                  nirq = DIV_ROUND_UP(ngpio, 16);
   227  
   228          chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL);
   229          if (!chips)
   230                  return -ENOMEM;
   231  
   232          gpio_base = devm_platform_ioremap_resource(pdev, 0);
   233          if (IS_ERR(gpio_base))
   234                  return PTR_ERR(gpio_base);
   235  
   236          for (i = 0; i < nirq; i++) {
   237                  chips->irqs[i] = platform_get_irq(pdev, i);
                                   ^^^

   238                  if (chips->irqs[i] < 0)
   239                          return chips->irqs[i];
   240          }

regards,
dan carpenter