From patchwork Tue Apr 6 07:02:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 416233 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B042C433B4 for ; Tue, 6 Apr 2021 07:00:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 539CB613B8 for ; Tue, 6 Apr 2021 07:00:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244113AbhDFHA3 (ORCPT ); Tue, 6 Apr 2021 03:00:29 -0400 Received: from mga04.intel.com ([192.55.52.120]:9889 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244110AbhDFHA3 (ORCPT ); Tue, 6 Apr 2021 03:00:29 -0400 IronPort-SDR: Dd/W/VZP5HpBigIH+1ZyWr/C9JIthTm1/GDG7IZFUpBQfdbFXwN0dXVDbQoA9CSgDpIsyzv9uF rod4svsRGpXA== X-IronPort-AV: E=McAfee;i="6000,8403,9945"; a="190835034" X-IronPort-AV: E=Sophos;i="5.81,308,1610438400"; d="scan'208";a="190835034" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Apr 2021 00:00:22 -0700 IronPort-SDR: kiYWw04oGmiAnO5c/EIMZcvsEWw5jAd8JGNgToVHucWdulD9NLhzk70OOp40rZJGubaVirJIV4 cZLS5Tzog2cg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,308,1610438400"; d="scan'208";a="448443193" Received: from mattu-haswell.fi.intel.com ([10.237.72.170]) by fmsmga002.fm.intel.com with ESMTP; 06 Apr 2021 00:00:20 -0700 From: Mathias Nyman To: Cc: , Mathias Nyman Subject: [PATCH 3/4] xhci: fix potential array out of bounds with several interrupters Date: Tue, 6 Apr 2021 10:02:07 +0300 Message-Id: <20210406070208.3406266-4-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210406070208.3406266-1-mathias.nyman@linux.intel.com> References: <20210406070208.3406266-1-mathias.nyman@linux.intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The Max Interrupters supported by the controller is given in a 10bit wide bitfield, but the driver uses a fixed 128 size array to index these interrupters. Klockwork reports a possible array out of bounds case which in theory is possible. In practice this hasn't been hit as a common number of Max Interrupters for new controllers is 8, not even close to 128. This needs to be fixed anyway Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index f9614716ecd7..ca9385d22f68 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -227,6 +227,7 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) struct device *dev = xhci_to_hcd(xhci)->self.sysdev; int err, i; u64 val; + u32 intrs; /* * Some Renesas controllers get into a weird state if they are @@ -265,7 +266,10 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) if (upper_32_bits(val)) xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring); - for (i = 0; i < HCS_MAX_INTRS(xhci->hcs_params1); i++) { + intrs = min_t(u32, HCS_MAX_INTRS(xhci->hcs_params1), + ARRAY_SIZE(xhci->run_regs->ir_set)); + + for (i = 0; i < intrs; i++) { struct xhci_intr_reg __iomem *ir; ir = &xhci->run_regs->ir_set[i];