linux-kernel - [PATCH 10/14] iommu/mediatek-v1: add missing larb count sanity check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250925122756.10910-11-johan@kernel.org>
Date: Thu, 25 Sep 2025 14:27:52 +0200
From: Johan Hovold <johan@...nel.org>
To: Joerg Roedel <joro@...tes.org>,
	Will Deacon <will@...nel.org>
Cc: Robin Murphy <robin.murphy@....com>,
	Sven Peter <sven@...nel.org>,
	Janne Grunau <j@...nau.net>,
	Rob Clark <robin.clark@....qualcomm.com>,
	Marek Szyprowski <m.szyprowski@...sung.com>,
	Yong Wu <yong.wu@...iatek.com>,
	Matthias Brugger <matthias.bgg@...il.com>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	Chen-Yu Tsai <wens@...e.org>,
	Thierry Reding <thierry.reding@...il.com>,
	Krishna Reddy <vdumpa@...dia.com>,
	iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Johan Hovold <johan@...nel.org>
Subject: [PATCH 10/14] iommu/mediatek-v1: add missing larb count sanity check

Add the missing larb count sanity check to avoid writing beyond a fixed
sized array in case of a malformed devicetree.

Signed-off-by: Johan Hovold <johan@...nel.org>
---
 drivers/iommu/mtk_iommu_v1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 44b965a2db92..55d6615a41a9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -643,6 +643,9 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 	if (larb_nr < 0)
 		return larb_nr;
 
+	if (larb_nr > MTK_LARB_NR_MAX)
+		return -EINVAL;
+
 	for (i = 0; i < larb_nr; i++) {
 		struct device_node *larbnode;
 		struct platform_device *plarbdev;
-- 
2.49.1