From patchwork Thu Aug 29 02:58:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jian Hui Lee X-Patchwork-Id: 13782409 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 04C5EC54FC6 for ; Thu, 29 Aug 2024 02:59:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=+h//h1u4VNN8yQMA42JFOOJYxZB7jSPI+KUI4YrKMnk=; b=VriXHLWKr+p5WPbFbr3TFAJvRF IPjIkNkGtsM+AAYshABg9olgab16yk5H8yNShzanBcDPhW+71a4EZ+cSR10DJ+vzkB0yi5RB2TJwo eWZIwIIUpNwfjQUthHX2NctBHst5ZPAa61H+Ah0iq55wqpY5L1t1WYajaUOIj2ezUyAVjJ7fNTN0u lLEFO4v3gnn1MOb/IpOjgdWFeCmRPcaF6FBlVoGc55utJRvtsJ5Yhii2wfSTv9Nx8sw2HJj9v1VhA lSIEQ4vuICeP/gNVFKx2BEyuEy2+1EO547UnnzF2/H4xIQDzzRHPj39G/88gbv68lLexRIZFAVaN6 Nv3ok5hg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sjVNe-00000000HrQ-43jp; Thu, 29 Aug 2024 02:59:26 +0000 Received: from smtp-relay-internal-1.canonical.com ([185.125.188.123]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sjVMX-00000000Hjp-1lLx for linux-arm-kernel@lists.infradead.org; Thu, 29 Aug 2024 02:58:19 +0000 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 849BD3F4C6 for ; Thu, 29 Aug 2024 02:58:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1724900293; bh=+h//h1u4VNN8yQMA42JFOOJYxZB7jSPI+KUI4YrKMnk=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=k0TfSTEpDHA25lJfz6WwurOoElL6rwszdZqQtbwgI7nHeOX4BrrIWPYjcpI1oHiNl w0cbs8gxgsW6cJysfeB187kHseIITXf1AliTcs8RguhRvj42Cv0m0iCtdQMAzRvFfT EeMSPO1JCVVShJWEQqVvYoc7XNXVTiQC8NgK8+d6dyThzc4odzf0T9cN6T5IO4WHcQ dcSp+kekwjPMaWVpWVZ0HYkBAiC/L2ODuocDVnZ9Gwd7ea6h/W9inNHrR/NU+VbPAO QBN/DtoeURimInbJH6QxJDlLZdcDlwyuFw/M4vU/8upvhg6t7ZL0KLHyAkLu1M3UmL oVeGx2zG/e6NQ== Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-201e94a71a0so2015335ad.1 for ; Wed, 28 Aug 2024 19:58:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724900292; x=1725505092; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=+h//h1u4VNN8yQMA42JFOOJYxZB7jSPI+KUI4YrKMnk=; b=vgZRjHtIWvLlrcx3J1EUBq2+668w1D3YTR6emRGcaSgpCkLeUcmiJyn0SxsMuJi33I Lp2ya5yWv7HZleHyJ0tJIlDknTRENqQAqPwukZFGrAjYtA9nN8ByZ+F/LVSOeCvAmQhb NGCvzTzUrzSml6JV//MmMz9Dj0rZmdKk6lD+bGNbVcqrnNY3blVl1wJ1XrnqX9QF2Uub cd3qrk8HGu7Z4de7h5r6AA4XNQ6fR4pAcr7g4P2OCITjb75sdRQOyyeRHVgR7GusTxyl InFP0kFhRFrq6W6RI/7tIhPVD2Vx9SFgqGTRt1EyTRkfwwIzb2qMXrBO1JB0BPCqyYo3 mvZQ== X-Forwarded-Encrypted: i=1; AJvYcCV9RIAr5XTsrXkSmTY5VcW+t1fHssYKdUZj4pUQIE8+R/CmpmrrGHFmjTCnjxwagZnTs65SQHCzyVK2cQ+DhelS@lists.infradead.org X-Gm-Message-State: AOJu0Yxup2HuF4EXCUF1ZLdnPt0Jy5g/5wHlXsGHWqfdPO80eVq4Rsrg uaBG9X47HnikI2YjdttAMAuTSWrqXbI5ihCfKPcqSEhgQJGS4jadrKMB4hmR48gCW+ia2OKQwF3 x3uWtXpTnU6MlA48NNoA8rqM2NVt8LeR70wtNFduIU6FtZKshAyoOc2lRz0yEGfC8pbM5/Ige0d 2HWW2XHTS/nkWb X-Received: by 2002:a17:902:7087:b0:201:e2db:7be7 with SMTP id d9443c01a7336-20516743038mr2750535ad.13.1724900291981; Wed, 28 Aug 2024 19:58:11 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGmbNWB34P18PQrxN3YT3XzJ2HAHmZtxZEyX9snuPC9wbBVBdVqO8dkGpqgtAZz0xb2gwNf0w== X-Received: by 2002:a17:902:7087:b0:201:e2db:7be7 with SMTP id d9443c01a7336-20516743038mr2750335ad.13.1724900291565; Wed, 28 Aug 2024 19:58:11 -0700 (PDT) Received: from solution.. (125-228-254-191.hinet-ip.hinet.net. [125.228.254.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-205155528d9sm1666315ad.264.2024.08.28.19.58.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Aug 2024 19:58:11 -0700 (PDT) From: Jian Hui Lee To: Liam Girdwood , Mark Brown , Matthias Brugger , AngeloGioacchino Del Regno , Axel Lin , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH] regulator: mt6359: Fix UBSAN shift-out-of-bounds Date: Thu, 29 Aug 2024 10:58:07 +0800 Message-ID: <20240829025807.2455823-1-jianhui.lee@canonical.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240828_195817_803419_F8C98AE5 X-CRM114-Status: GOOD ( 14.13 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org A shift-out-of-bounds will occur as caught by LTP fs:read_all_sys, if modeset_mask has not been set for MT6359_LDO_LINEAR regulators. Example command on MediaTek Genio 1200-EVK: # cat /sys/devices/platform/soc/10024000.pwrap/10024000.pwrap\:pmic/regulator/regulator.28/opmode This patch initializes the member modeset_reg to zero, and checks it before any further actions. The related log: UBSAN: shift-out-of-bounds in ../drivers/regulator/mt6359-regulator.c:281:9 shift exponent -1 is negative CPU: 1 UID: 0 PID: 4473 Comm: cat Not tainted 6.11.0-rc2-custom #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022 Call trace: dump_backtrace+0xa0/0x148 show_stack+0x20/0x48 dump_stack_lvl+0x80/0x130 dump_stack+0x18/0x30 __ubsan_handle_shift_out_of_bounds+0x144/0x250 mt6359_regulator_get_mode+0x154/0x160 [mt6359_regulator] opmode_show+0x84/0x150 dev_attr_show+0x28/0xa8 sysfs_kf_seq_show+0x90/0x180 kernfs_seq_show+0x34/0x60 seq_read_iter+0x1f0/0x518 kernfs_fop_read_iter+0x170/0x220 vfs_read+0x288/0x338 ksys_read+0x70/0x120 __arm64_sys_read+0x24/0x48 invoke_syscall+0x70/0x120 el0_svc_common.constprop.0+0x48/0x138 do_el0_svc+0x28/0x58 el0_svc+0x40/0x1a8 el0t_64_sync_handler+0x15c/0x178 el0t_64_sync+0x1a8/0x1b0 ---[ end trace ]--- Fixes: d6208ba87066 ("regulator: mt6359: Remove shift fields from struct mt6359_regulator_info") Suggested-by: Yu-wen Fang Signed-off-by: Jian Hui Lee --- drivers/regulator/mt6359-regulator.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/regulator/mt6359-regulator.c b/drivers/regulator/mt6359-regulator.c index c8a788858824..24b1dcc5eee8 100644 --- a/drivers/regulator/mt6359-regulator.c +++ b/drivers/regulator/mt6359-regulator.c @@ -88,6 +88,7 @@ struct mt6359_regulator_info { .enable_reg = _enable_reg, \ .enable_mask = BIT(0), \ }, \ + .modeset_reg = 0, \ .status_reg = _status_reg, \ .qi = BIT(0), \ } @@ -270,6 +271,9 @@ static unsigned int mt6359_regulator_get_mode(struct regulator_dev *rdev) struct mt6359_regulator_info *info = rdev_get_drvdata(rdev); int ret, regval; + if (!info->modeset_reg) + return REGULATOR_MODE_NORMAL; + ret = regmap_read(rdev->regmap, info->modeset_reg, ®val); if (ret != 0) { dev_err(&rdev->dev, @@ -303,6 +307,9 @@ static int mt6359_regulator_set_mode(struct regulator_dev *rdev, int ret = 0, val; int curr_mode; + if (!info->modeset_reg) + return -EINVAL; + curr_mode = mt6359_regulator_get_mode(rdev); switch (mode) { case REGULATOR_MODE_FAST: