Patch "ata: libahci_platform: Sanity check the DT child nodes number" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ata: libahci_platform: Sanity check the DT child nodes number

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ata-libahci_platform-sanity-check-the-dt-child-nodes.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c23ecfd5f913789c9a7cde6b6862b4fa7895a2d0
Author: Serge Semin <Sergey.Semin@xxxxxxxxxxxxxxxxxxxx>
Date:   Fri Sep 9 22:36:06 2022 +0300

    ata: libahci_platform: Sanity check the DT child nodes number
    
    [ Upstream commit 3c132ea6508b34956e5ed88d04936983ec230601 ]
    
    Having greater than AHCI_MAX_PORTS (32) ports detected isn't that critical
    from the further AHCI-platform initialization point of view since
    exceeding the ports upper limit will cause allocating more resources than
    will be used afterwards. But detecting too many child DT-nodes doesn't
    seem right since it's very unlikely to have it on an ordinary platform. In
    accordance with the AHCI specification there can't be more than 32 ports
    implemented at least due to having the CAP.NP field of 5 bits wide and the
    PI register of dword size. Thus if such situation is found the DTB must
    have been corrupted and the data read from it shouldn't be reliable. Let's
    consider that as an erroneous situation and halt further resources
    allocation.
    
    Note it's logically more correct to have the nports set only after the
    initialization value is checked for being sane. So while at it let's make
    sure nports is assigned with a correct value.
    
    Signed-off-by: Serge Semin <Sergey.Semin@xxxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Hannes Reinecke <hare@xxxxxxx>
    Signed-off-by: Damien Le Moal <damien.lemoal@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 0910441321f7..64d6da0a5303 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -451,14 +451,24 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
 		}
 	}
 
-	hpriv->nports = child_nodes = of_get_child_count(dev->of_node);
+	/*
+	 * Too many sub-nodes most likely means having something wrong with
+	 * the firmware.
+	 */
+	child_nodes = of_get_child_count(dev->of_node);
+	if (child_nodes > AHCI_MAX_PORTS) {
+		rc = -EINVAL;
+		goto err_out;
+	}
 
 	/*
 	 * If no sub-node was found, we still need to set nports to
 	 * one in order to be able to use the
 	 * ahci_platform_[en|dis]able_[phys|regulators] functions.
 	 */
-	if (!child_nodes)
+	if (child_nodes)
+		hpriv->nports = child_nodes;
+	else
 		hpriv->nports = 1;
 
 	hpriv->phys = devm_kcalloc(dev, hpriv->nports, sizeof(*hpriv->phys), GFP_KERNEL);