From patchwork Wed May 11 06:49:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?WW9uZyBXdSAo5ZC05YuHKQ==?= X-Patchwork-Id: 12845856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F0AD0C433F5 for ; Wed, 11 May 2022 06:52:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=JF9Jf+hQ6bG/3rKCmNJKPwOECSXkHGgxTgq2lknUxBE=; b=KHy6wjiPR7wvus CK105VxrGYRRZgxtC2+h1JPZX+pccRV9w2cQcc/RSf0ZwVSUfULLwA2JgTj7DsnDhIb65IomJMeKC htnk4zKTwWFSVepHmlZHalcPd6jAlUP0B4AkMTDwERLFUmr1TeGFRjVwoP/BhLEoYB5QGsFb6xRKS 3AYh+mVs9gW8ql1DKxyo4Ouvb57XRHBOTQXcsrS/Icg3gwdeUAzzoc29RdddXfLoLFipV704Nm9bx RrUU+oPFSLz+ZoxKtoF3eRL09fwR2aed7MLyptiI7RuXLNXJGg1vuRcEp61wqzjuZfcO+Nzy/tX4F JtI+ByM79D7Eicq7CMng==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBc-005Z5C-H0; Wed, 11 May 2022 06:51:04 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nogBW-005Z0x-Ik; Wed, 11 May 2022 06:50:59 +0000 X-UUID: 211d69203519445b895dd84258510fed-20220510 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4, REQID:b18fe6dd-be20-496b-88c3-9c92e1c9e7ae, OB:0, LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9, CLOUDID:abf363b3-56b5-4c9e-8d83-0070b288eb6a, C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 211d69203519445b895dd84258510fed-20220510 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1134001176; Tue, 10 May 2022 23:50:49 -0700 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 10 May 2022 23:50:05 -0700 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 From: Yong Wu To: Joerg Roedel , Will Deacon , "Matthias Brugger" CC: , , , , "Yong Wu" , AngeloGioacchino Del Regno , , , , , , , , Guenter Roeck , "Dan Carpenter" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek, larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220510_235058_653329_270C77DB X-CRM114-Status: GOOD ( 16.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m larb_nr = of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NULL); if (larb_nr < 0) return larb_nr; + if (larb_nr == 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; for (i = 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id = i; + if (id >= MTK_LARB_NR_MAX) { + ret = -EINVAL; + goto err_larbnode_put; + } plarbdev = of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m ret = -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret = -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev = &plarbdev->dev; component_match_add_release(dev, match, component_release_of,