From: ChiYuan Huang <cy_huang@xxxxxxxxxxx> Fix the potential risk if virtual bank index is over the maximum. Refer to the discussion list on mt6370. https://lore.kernel.org/all/20220914013345.GA5802@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/ If not to check the boundary, there is also the same issue on mt6360. For mt6360 register virtual mapping, the normal range is 0 to 0x3FF. Below's the backtrace in my experiment to access mt6360 0x400 register with regmap_raw_read() and regmap_raw_write() function. 1) regmap_raw_read() Unable to handle kernel execute from non-executable memory at virtual address ffffffd4940c4c20 pc : platform_bus+0x8/0x2e8 lr : i2c_smbus_xfer+0x60/0x120 Call trace: platform_bus+0x8/0x2e8 i2c_smbus_read_i2c_block_data+0x74/0xc0 mt6360_regmap_read+0x9c/0x180 [mt6360_core] _regmap_raw_read+0xe4/0x278 regmap_raw_read+0xec/0x240 2) regmap_raw_write() Unable to handle kernel execute from non-executable memory at virtual address ffffffe4a0ac4c20 pc : platform_bus+0x8/0x2e8 lr : i2c_smbus_xfer+0x60/0x120 Call trace: platform_bus+0x8/0x2e8 i2c_smbus_write_i2c_block_data+0x84/0xd0 mt6360_regmap_write+0xa8/0x150 [mt6360_core] _regmap_raw_write_impl+0x6e8/0x828 _regmap_raw_write+0xb4/0x130 regmap_raw_write+0x74/0xb0 After adding the boundary check, the above two cases can be solved. Fixes: 3b0850440a06c (mfd: mt6360: Merge different sub-devices I2C read/write) Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: ChiYuan Huang <cy_huang@xxxxxxxxxxx> --- Since v3: - Add backtrace log to help understanding what the potential risk is. Since v2: - Assign i2c bank variable after bank index is already checked. --- drivers/mfd/mt6360-core.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/mfd/mt6360-core.c b/drivers/mfd/mt6360-core.c index 6eaa677..d3b32eb 100644 --- a/drivers/mfd/mt6360-core.c +++ b/drivers/mfd/mt6360-core.c @@ -402,7 +402,7 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size, struct mt6360_ddata *ddata = context; u8 bank = *(u8 *)reg; u8 reg_addr = *(u8 *)(reg + 1); - struct i2c_client *i2c = ddata->i2c[bank]; + struct i2c_client *i2c; bool crc_needed = false; u8 *buf; int buf_len = MT6360_ALLOC_READ_SIZE(val_size); @@ -410,6 +410,11 @@ static int mt6360_regmap_read(void *context, const void *reg, size_t reg_size, u8 crc; int ret; + if (bank >= MT6360_SLAVE_MAX) + return -EINVAL; + + i2c = ddata->i2c[bank]; + if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) { crc_needed = true; ret = mt6360_xlate_pmicldo_addr(®_addr, val_size); @@ -453,13 +458,18 @@ static int mt6360_regmap_write(void *context, const void *val, size_t val_size) struct mt6360_ddata *ddata = context; u8 bank = *(u8 *)val; u8 reg_addr = *(u8 *)(val + 1); - struct i2c_client *i2c = ddata->i2c[bank]; + struct i2c_client *i2c; bool crc_needed = false; u8 *buf; int buf_len = MT6360_ALLOC_WRITE_SIZE(val_size); int write_size = val_size - MT6360_REGMAP_REG_BYTE_SIZE; int ret; + if (bank >= MT6360_SLAVE_MAX) + return -EINVAL; + + i2c = ddata->i2c[bank]; + if (bank == MT6360_SLAVE_PMIC || bank == MT6360_SLAVE_LDO) { crc_needed = true; ret = mt6360_xlate_pmicldo_addr(®_addr, val_size - MT6360_REGMAP_REG_BYTE_SIZE); -- 2.7.4
