[PATCH 0/2] regcache: Validate bounds of regcache drop requests

[PATCH 0/2] regcache: Validate bounds of regcache drop requests

[Mark Brown]

It is not valid for a caller to try to drop a range of registers from
the cache where the minimum register is greater than the maximum register,
and doing so is likely to trigger bugs in the caches.  Reject such
invalid inputs and add a KUnit test for it.

---
Mark Brown (2):
      regcache: Validate bounds of regcache drop requests
      regcache: Add test for bounds checking of regcache drop requests

 drivers/base/regmap/regcache.c     |  3 +++
 drivers/base/regmap/regmap-kunit.c | 21 +++++++++++++++++++++
 2 files changed, 24 insertions(+)
---
base-commit: 2dee91ee94eec85d09c13c7ca83e3005906d3732
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.4
change-id: 20261026-regmap-drop-region-min-max-b1ff4cc203b3

Best regards,
--  
Mark Brown <broonie@kernel.org>

[PATCH 1/2] regcache: Validate bounds of regcache drop requests

[Mark Brown]

It is not valid for a caller to try to drop a range of registers from
the cache where the minimum register is greater than the maximum
register, and doing so is likely to trigger bugs in the caches.  Reject
such invalid inputs.

Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regcache.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 774e9c9bf3c4..1447967ff00b 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -589,6 +589,9 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
 
 	trace_regcache_drop_region(map, min, max);
 
+	if (min > max)
+		return -EINVAL;
+
 	return map->cache_ops->drop(map, min, max);
 }
 EXPORT_SYMBOL_GPL(regcache_drop_region);

-- 
2.47.3

[PATCH 2/2] regcache: Add test for bounds checking of regcache drop requests

[Mark Brown]

Validate that regcache_drop_region() rejects regions with a minimum
greater than the maximum.

Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regmap-kunit.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/base/regmap/regmap-kunit.c b/drivers/base/regmap/regmap-kunit.c
index c78772b660d6..c948219f46a3 100644
--- a/drivers/base/regmap/regmap-kunit.c
+++ b/drivers/base/regmap/regmap-kunit.c
@@ -1347,6 +1347,26 @@ static void cache_drop(struct kunit *test)
 	KUNIT_EXPECT_MEMEQ(test, &data->vals[param->from_reg], rval, sizeof(rval));
 }
 
+static void cache_drop_min_max(struct kunit *test)
+{
+	const struct regmap_test_param *param = test->param_value;
+	struct regmap *map;
+	struct regmap_config config;
+	struct regmap_ram_data *data;
+
+	config = test_regmap_config;
+	config.num_reg_defaults = BLOCK_TEST_SIZE;
+
+	map = gen_regmap(test, &config, &data);
+	KUNIT_ASSERT_FALSE(test, IS_ERR(map));
+	if (IS_ERR(map))
+		return;
+
+	/* Drop some registers */
+	KUNIT_EXPECT_EQ(test, -EINVAL, regcache_drop_region(map, param->from_reg + 5,
+							    param->from_reg + 3));
+}
+
 static void cache_drop_with_non_contiguous_ranges(struct kunit *test)
 {
 	const struct regmap_test_param *param = test->param_value;
@@ -2253,6 +2273,7 @@ static struct kunit_case regmap_test_cases[] = {
 	KUNIT_CASE_PARAM(cache_sync_readonly, real_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_sync_patch, real_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop, sparse_cache_types_gen_params),
+	KUNIT_CASE_PARAM(cache_drop_min_max, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_with_non_contiguous_ranges, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_all_and_sync_marked_dirty, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_all_and_sync_no_defaults, sparse_cache_types_gen_params),

-- 
2.47.3

Re: [PATCH 0/2] regcache: Validate bounds of regcache drop requests

[Mark Brown]

On Mon, 26 Oct 2026 23:32:06 +0000, Mark Brown wrote:
> regcache: Validate bounds of regcache drop requests
> 
> It is not valid for a caller to try to drop a range of registers from
> the cache where the minimum register is greater than the maximum register,
> and doing so is likely to trigger bugs in the caches.  Reject such
> invalid inputs and add a KUnit test for it.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.5

Thanks!

[1/2] regcache: Validate bounds of regcache drop requests
      https://git.kernel.org/broonie/regmap/c/0334cc4c6e26
[2/2] regcache: Add test for bounds checking of regcache drop requests
      https://git.kernel.org/broonie/regmap/c/3547211537fd

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark