| Message ID | 20240719122153.1987-1-adiupina@astralinux.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] PCI: kirin: Fix buffer overflow | expand |
just a friendly reminder 19/07/24 15:21, Alexandra Diupina пишет: > In kirin_pcie_parse_port() pcie->num_slots is compared to > pcie->gpio_id_reset size (MAX_PCI_SLOTS). Need to fix > condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move > pcie->num_slots increment lower to avoid out-of-bounds > array access. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: b22dbbb24571 ("PCI: kirin: Support PERST# GPIOs for HiKey970 external PEX 8606 bridge") > Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> > --- > v2: some changes > drivers/pci/controller/dwc/pcie-kirin.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c > index d5523f302102..deab1e653b9a 100644 > --- a/drivers/pci/controller/dwc/pcie-kirin.c > +++ b/drivers/pci/controller/dwc/pcie-kirin.c > @@ -412,12 +412,12 @@ static int kirin_pcie_parse_port(struct kirin_pcie *pcie, > if (pcie->gpio_id_reset[i] < 0) > continue; > > - pcie->num_slots++; > - if (pcie->num_slots > MAX_PCI_SLOTS) { > + if (pcie->num_slots + 1 >= MAX_PCI_SLOTS) { > dev_err(dev, "Too many PCI slots!\n"); > ret = -EINVAL; > goto put_node; > } > + pcie->num_slots++; > > ret = of_pci_get_devfn(child); > if (ret < 0) {
Hello,
> just a friendly reminder
Would you mind sending a v2 as a standalone patch? So that I can pick it
up via Patchwork and such. I would be much obliged.
I wonder if Mauro would be willing to have another review of the new
iteration of the fix. Just something that would be nice to have his
tag added.
Krzysztof
Em Fri, 19 Jul 2024 15:21:53 +0300 Alexandra Diupina <adiupina@astralinux.ru> escreveu: > In kirin_pcie_parse_port() pcie->num_slots is compared to > pcie->gpio_id_reset size (MAX_PCI_SLOTS). Need to fix > condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move > pcie->num_slots increment lower to avoid out-of-bounds > array access. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: b22dbbb24571 ("PCI: kirin: Support PERST# GPIOs for HiKey970 external PEX 8606 bridge") > Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> LGTM. Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> > --- > v2: some changes > drivers/pci/controller/dwc/pcie-kirin.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c > index d5523f302102..deab1e653b9a 100644 > --- a/drivers/pci/controller/dwc/pcie-kirin.c > +++ b/drivers/pci/controller/dwc/pcie-kirin.c > @@ -412,12 +412,12 @@ static int kirin_pcie_parse_port(struct kirin_pcie *pcie, > if (pcie->gpio_id_reset[i] < 0) > continue; > > - pcie->num_slots++; > - if (pcie->num_slots > MAX_PCI_SLOTS) { > + if (pcie->num_slots + 1 >= MAX_PCI_SLOTS) { > dev_err(dev, "Too many PCI slots!\n"); > ret = -EINVAL; > goto put_node; > } > + pcie->num_slots++; > > ret = of_pci_get_devfn(child); > if (ret < 0) { Thanks, Mauro
diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c index d5523f302102..deab1e653b9a 100644 --- a/drivers/pci/controller/dwc/pcie-kirin.c +++ b/drivers/pci/controller/dwc/pcie-kirin.c @@ -412,12 +412,12 @@ static int kirin_pcie_parse_port(struct kirin_pcie *pcie, if (pcie->gpio_id_reset[i] < 0) continue; - pcie->num_slots++; - if (pcie->num_slots > MAX_PCI_SLOTS) { + if (pcie->num_slots + 1 >= MAX_PCI_SLOTS) { dev_err(dev, "Too many PCI slots!\n"); ret = -EINVAL; goto put_node; } + pcie->num_slots++; ret = of_pci_get_devfn(child); if (ret < 0) {
In kirin_pcie_parse_port() pcie->num_slots is compared to pcie->gpio_id_reset size (MAX_PCI_SLOTS). Need to fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move pcie->num_slots increment lower to avoid out-of-bounds array access. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b22dbbb24571 ("PCI: kirin: Support PERST# GPIOs for HiKey970 external PEX 8606 bridge") Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> --- v2: some changes drivers/pci/controller/dwc/pcie-kirin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)