The bcom_psc_params[] array has 6 entries (indices 0-5), but
bcom_psc_gen_bd_rx_init() checked against MPC52xx_PSC_MAXNUM which can
be 12 when CONFIG_PPC_MPC512x is set, allowing indices 6-11 to pass
and read past the array. The tx init function had no bounds check at
all.
A malformed device tree with a large cell-index could therefore trigger
an out-of-bounds read. The garbage initiator and ipr values would then
be used for MMIO writes via out_8(&bcom_eng->regs->ipr[...], ...),
potentially causing out-of-bounds MMIO accesses.
Fix both functions to use ARRAY_SIZE(bcom_psc_params) for the bounds
check.
Also remove a stray unused 'struct psc;' forward declaration in
bcom_psc_gen_bd_tx_init.
Assisted-by: Opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/dma/bestcomm/gen_bd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/bestcomm/gen_bd.c b/drivers/dma/bestcomm/gen_bd.c
index 61b5746e1a97..00dfdc4b8eba 100644
--- a/drivers/dma/bestcomm/gen_bd.c
+++ b/drivers/dma/bestcomm/gen_bd.c
@@ -321,7 +321,7 @@ static const struct bcom_psc_params bcom_psc_params[] = {
struct bcom_task * bcom_psc_gen_bd_rx_init(unsigned psc_num, int queue_len,
phys_addr_t fifo, int maxbufsize)
{
- if (psc_num >= MPC52xx_PSC_MAXNUM)
+ if (psc_num >= ARRAY_SIZE(bcom_psc_params))
return NULL;
return bcom_gen_bd_rx_init(queue_len, fifo,
@@ -342,7 +342,9 @@ EXPORT_SYMBOL_GPL(bcom_psc_gen_bd_rx_init);
struct bcom_task *
bcom_psc_gen_bd_tx_init(unsigned psc_num, int queue_len, phys_addr_t fifo)
{
- struct psc;
+ if (psc_num >= ARRAY_SIZE(bcom_psc_params))
+ return NULL;
+
return bcom_gen_bd_tx_init(queue_len, fifo,
bcom_psc_params[psc_num].tx_initiator,
bcom_psc_params[psc_num].tx_ipr);
--
2.54.0