Message ID | 20230825101532.6624-1-m.kobuk@ispras.ru |
---|---|
State | Accepted |
Commit | 87d315a34133edcb29c4cadbf196ec6c30dfd47b |
Headers | show |
Series | pinctrl: nuvoton: wpcm450: fix out of bounds write | expand |
On Fri, Aug 25, 2023 at 12:15 PM Mikhail Kobuk <m.kobuk@ispras.ru> wrote: > Write into 'pctrl->gpio_bank' happens before the check for GPIO index > validity, so out of bounds write may happen. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: a1d1e0e3d80a ("pinctrl: nuvoton: Add driver for WPCM450") > Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru> > Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Patch applied for fixes. Yours, Linus Walleij
diff --git a/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c b/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c index 2d1c1652cfd9..8a9961ac8712 100644 --- a/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c +++ b/drivers/pinctrl/nuvoton/pinctrl-wpcm450.c @@ -1062,13 +1062,13 @@ static int wpcm450_gpio_register(struct platform_device *pdev, if (ret < 0) return ret; - gpio = &pctrl->gpio_bank[reg]; - gpio->pctrl = pctrl; - if (reg >= WPCM450_NUM_BANKS) return dev_err_probe(dev, -EINVAL, "GPIO index %d out of range!\n", reg); + gpio = &pctrl->gpio_bank[reg]; + gpio->pctrl = pctrl; + bank = &wpcm450_banks[reg]; gpio->bank = bank;