From: Xiaolei Wang <xiaolei.wang@windriver.com>
To: lgirdwood@gmail.com, broonie@kernel.org
Cc: linux-kernel@vger.kernel.org
Subject: [v2][PATCH] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
Date: Thu, 25 Aug 2022 19:19:22 +0800 [thread overview]
Message-ID: <20220825111922.1368055-1-xiaolei.wang@windriver.com> (raw)
The pfuze_chip::regulator_descs is an array of size
PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators
is the pointer to the real regulators of a specific device.
The number of real regulator is supposed to be less than
the PFUZE100_MAX_REGULATOR, so we should use the size of
'regulator_num * sizeof(struct pfuze_regulator)' in memcpy().
This fixes the out of bounds access bug reported by KASAN.
BUG: KASAN: global-out-of-bounds in pfuze100_regulator_probe+0x380/0x8b8
Read of size 3968 at addr c3390640 by task swapper/0/1
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-yocto-standard+ #2
Hardware name: Freescale i.MX6 SoloX (Device Tree)
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x68/0x90
dump_stack_lvl from print_report+0x58/0x4c8
print_report from kasan_report+0x7c/0x98
kasan_report from kasan_check_range+0x20/0x170
kasan_check_range from memcpy+0x28/0x68
memcpy from pfuze100_regulator_probe+0x380/0x8b8
pfuze100_regulator_probe from i2c_device_probe+0x37c/0x39c
i2c_device_probe from really_probe+0x1cc/0x398
really_probe from __driver_probe_device+0x118/0x124
__driver_probe_device from driver_probe_device+0x5c/0xf0
driver_probe_device from __driver_attach+0x144/0x160
__driver_attach from bus_for_each_dev+0xf4/0x12c
bus_for_each_dev from bus_add_driver+0x124/0x264
bus_add_driver from driver_register+0x130/0x188
driver_register from i2c_register_driver+0x80/0xa8
i2c_register_driver from do_one_initcall+0x180/0x39c
do_one_initcall from kernel_init_freeable+0x374/0x3cc
kernel_init_freeable from kernel_init+0x1c/0x150
kernel_init from ret_from_fork+0x14/0x2c
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
---
drivers/regulator/pfuze100-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 6b617024a67d..d899d6e98fb8 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -766,7 +766,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
- sizeof(pfuze_chip->regulator_descs));
+ regulator_num * sizeof(struct pfuze_regulator));
ret = pfuze_parse_regulators_dt(pfuze_chip);
if (ret)
--
2.25.1
next reply other threads:[~2022-08-25 11:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-25 11:19 Xiaolei Wang [this message]
2022-08-25 13:09 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220825111922.1368055-1-xiaolei.wang@windriver.com \
--to=xiaolei.wang@windriver.com \
--cc=broonie@kernel.org \
--cc=lgirdwood@gmail.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®