From patchwork Tue Nov 7 11:05:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Borneo X-Patchwork-Id: 742118 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A677C4332F for ; Tue, 7 Nov 2023 11:06:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233960AbjKGLGY (ORCPT ); Tue, 7 Nov 2023 06:06:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234213AbjKGLGX (ORCPT ); Tue, 7 Nov 2023 06:06:23 -0500 Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CFFAEA; Tue, 7 Nov 2023 03:06:20 -0800 (PST) Received: from pps.filterd (m0046661.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.22/8.17.1.22) with ESMTP id 3A7Ab30n023702; Tue, 7 Nov 2023 12:06:00 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h= from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding:content-type; s=selector1; bh=GsZbf1O usFrNfhIV1CDJxzRVyg3nK7nEux7A+R3rSug=; b=C94JsqqU67pqRk8zLjuDXnx DwAMqHuToFm3IR1gYqfTMzGtQvaWcmM7E8rnXvRCG5X7pmSHb9v4j+LzeNkTl5DA +2tl6wKCXhrk1oWV6cWL0z/2pxyAab/Yb/pNpq3UvQhx4iUhW6Y2Wzwr3t25B8CD Q+dWHcnGgxe0LLkRuc+guJLuctCoM/L1NhWgYhrsBfuPKPVozaolzDhN7/MS/uSp eZiqIv3afNqQp/xfKESkXtxwNjI8+JpEL2RMMx7SyJDlT1fb4c+Vey+HpJ/hsDYJ F++jJrm9Cd8Pj+Hrf74xu/kwmMYeDZK482St4Vj629/FLFLnhDZnPzMC6zSKiqA= = Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3u5ehtks2f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Nov 2023 12:06:00 +0100 (CET) Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id E012D100059; Tue, 7 Nov 2023 12:05:58 +0100 (CET) Received: from Webmail-eu.st.com (shfdag1node1.st.com [10.75.129.69]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id D2FB121ADBC; Tue, 7 Nov 2023 12:05:58 +0100 (CET) Received: from localhost (10.201.20.114) by SHFDAG1NODE1.st.com (10.75.129.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 7 Nov 2023 12:05:58 +0100 From: Antonio Borneo To: Linus Walleij , Maxime Coquelin , Alexandre Torgue , Rob Herring , Geert Uytterhoeven , Emil Renner Berthing , Valentin Caron , Dario Binacchi , =?utf-8?q?Bernhard_Ro?= =?utf-8?q?senkr=C3=A4nzer?= CC: Antonio Borneo , , , , Subject: [PATCH] pinctrl: stm32: fix array read out of bound Date: Tue, 7 Nov 2023 12:05:20 +0100 Message-ID: <20231107110520.4449-1-antonio.borneo@foss.st.com> X-Mailer: git-send-email 2.42.0 MIME-Version: 1.0 X-Originating-IP: [10.201.20.114] X-ClientProxiedBy: EQNCAS1NODE4.st.com (10.75.129.82) To SHFDAG1NODE1.st.com (10.75.129.69) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.987,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-11-07_01,2023-11-07_01,2023-05-22_02 Precedence: bulk List-ID: X-Mailing-List: linux-gpio@vger.kernel.org The existing code does not verify if the "tentative" index exceeds the size of the array, causing out of bound read. Issue identified with kasan. Check the index before using it. Signed-off-by: Antonio Borneo Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") --- drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c index a73385a431de..56677bad10f7 100644 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c @@ -1283,9 +1283,11 @@ static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pi int i; /* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */ - pin_desc = pctl->pins + stm32_pin_nb; - if (pin_desc->pin.number == stm32_pin_nb) - return pin_desc; + if (stm32_pin_nb < pctl->npins) { + pin_desc = pctl->pins + stm32_pin_nb; + if (pin_desc->pin.number == stm32_pin_nb) + return pin_desc; + } /* Otherwise, loop all array to find the pin with the right number */ for (i = 0; i < pctl->npins; i++) {