提交 c16ae609 编写于 作者: A Antonio Borneo 提交者: Marc Zyngier

irqchip/stm32-exti: Prevent illegal read due to unbounded DT value

The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips
reading outside the array boundary.

Check the value of hwirq before using it.
Signed-off-by: NAntonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: NMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20220606162757.415354-4-antonio.borneo@foss.st.com
上级 f8b3eb42
...@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, ...@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm,
int bank; int bank;
hwirq = fwspec->param[0]; hwirq = fwspec->param[0];
if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)
return -EINVAL;
bank = hwirq / IRQS_PER_BANK; bank = hwirq / IRQS_PER_BANK;
chip_data = &host_data->chips_data[bank]; chip_data = &host_data->chips_data[bank];
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册