On Fri, Jun 21, 2024 at 01:42:46PM +0300, Aleksandr Mishin wrote:
> In tsi148_crcsr_init() value of vme_base used as 3rd parameter in
> tsi148_master_set() call is calculated as 'vstat * 0x80000'. vstat value
> can be set from module parameter "geoid" which can be any. In this case
> the value of an arithmetic expression 'vstat * 0x80000' is a subject to
> overflow because its operands are not cast to a larger data type before
> performing arithmetic.
>
> Add geoid validation to prevent overflow.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
> Signed-off-by: Aleksandr Mishin <amishin@xxxxxxxxxx>
> ---
> drivers/staging/vme_user/vme_tsi148.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/vme_user/vme_tsi148.c b/drivers/staging/vme_user/vme_tsi148.c
> index 2ec9c2904404..b601d2b20bed 100644
> --- a/drivers/staging/vme_user/vme_tsi148.c
> +++ b/drivers/staging/vme_user/vme_tsi148.c
> @@ -2119,7 +2119,7 @@ static int tsi148_slot_get(struct vme_bridge *tsi148_bridge)
> slot = ioread32be(bridge->base + TSI148_LCSR_VSTAT);
> slot = slot & TSI148_LCSR_VSTAT_GA_M;
> } else {
> - slot = geoid;
> + slot = geoid & TSI148_LCSR_VSTAT_GA_M;
geoid is a module parameter. It would be better to add some validation
to the probe() function instead of working around invalid values here.
regards,
dan carpenter
