From nobody Sun Sep 22 04:48:26 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A82C7C433F5 for ; Wed, 11 May 2022 06:50:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242388AbiEKGuW (ORCPT ); Wed, 11 May 2022 02:50:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235515AbiEKGuN (ORCPT ); Wed, 11 May 2022 02:50:13 -0400 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66B865D190 for ; Tue, 10 May 2022 23:50:12 -0700 (PDT) X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.4,REQID:1f226f53-b785-49b6-bb50-1eb413231f61,OB:0,LO B:0,IP:0,URL:0,TC:0,Content:-20,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,AC TION:release,TS:-20 X-CID-META: VersionHash:faefae9,CLOUDID:23eb63b3-56b5-4c9e-8d83-0070b288eb6a,C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,File:nil,QS:0,BEC:nil X-UUID: 33d18a52e2a347b082f05c9c411eec43-20220511 Received: from mtkmbs10n2.mediatek.inc [(172.21.101.183)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1948481888; Wed, 11 May 2022 14:50:05 +0800 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.3; Wed, 11 May 2022 14:50:04 +0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 11 May 2022 14:50:03 +0800 Received: from localhost.localdomain (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 11 May 2022 14:50:02 +0800 From: Yong Wu To: Joerg Roedel , Will Deacon , "Matthias Brugger" CC: , , , , "Yong Wu" , AngeloGioacchino Del Regno , , , , , , , , Guenter Roeck , "Dan Carpenter" Subject: [PATCH 3/4] iommu/mediatek: Validate number of phandles associated with "mediatek,larbs" Date: Wed, 11 May 2022 14:49:19 +0800 Message-ID: <20220511064920.18455-4-yong.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20220511064920.18455-1-yong.wu@mediatek.com> References: <20220511064920.18455-1-yong.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Guenter Roeck Fix the smatch warnings: drivers/iommu/mtk_iommu.c:878 mtk_iommu_mm_dts_parse() error: uninitialized symbol 'larbnode'. If someone abuse the dtsi node(Don't follow the definition of dt-binding), for example "mediatek,larbs" is provided as boolean property, the code may crash. To fix this problem and improve the code safety, add some checking for the invalid input from dtsi, e.g. checking the larb_nr/larbid valid range, and avoid "mediatek,larb-id" property conflicts in the smi-larb nodes. Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYP= E") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Guenter Roeck Signed-off-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 523bf59264e1..1ba92751e9df 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1046,6 +1046,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev,= struct component_match **m larb_nr =3D of_count_phandle_with_args(dev->of_node, "mediatek,larbs", NU= LL); if (larb_nr < 0) return larb_nr; + if (larb_nr =3D=3D 0 || larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; =20 for (i =3D 0; i < larb_nr; i++) { u32 id; @@ -1062,6 +1064,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev= , struct component_match **m ret =3D of_property_read_u32(larbnode, "mediatek,larb-id", &id); if (ret)/* The id is consecutive if there is no this property */ id =3D i; + if (id >=3D MTK_LARB_NR_MAX) { + ret =3D -EINVAL; + goto err_larbnode_put; + } =20 plarbdev =3D of_find_device_by_node(larbnode); if (!plarbdev) { @@ -1072,6 +1078,11 @@ static int mtk_iommu_mm_dts_parse(struct device *dev= , struct component_match **m ret =3D -EPROBE_DEFER; goto err_larbnode_put; } + + if (data->larb_imu[id].dev) { + ret =3D -EEXIST; + goto err_larbnode_put; + } data->larb_imu[id].dev =3D &plarbdev->dev; =20 component_match_add_release(dev, match, component_release_of, --=20 2.18.0