[PATCH 0/2] regcache: Validate bounds of regcache drop requests

[PATCH 0/2] regcache: Validate bounds of regcache drop requests

[Mark Brown]

It is not valid for a caller to try to drop a range of registers from
the cache where the minimum register is greater than the maximum register,
and doing so is likely to trigger bugs in the caches.  Reject such
invalid inputs and add a KUnit test for it.

---
Mark Brown (2):
      regcache: Validate bounds of regcache drop requests
      regcache: Add test for bounds checking of regcache drop requests

 drivers/base/regmap/regcache.c     |  3 +++
 drivers/base/regmap/regmap-kunit.c | 21 +++++++++++++++++++++
 2 files changed, 24 insertions(+)
---
base-commit: 2dee91ee94eec85d09c13c7ca83e3005906d3732
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.4
change-id: 20261026-regmap-drop-region-min-max-b1ff4cc203b3

Best regards,
--  
Mark Brown <broonie@kernel.org>

[PATCH 1/2] regcache: Validate bounds of regcache drop requests

[Mark Brown]

It is not valid for a caller to try to drop a range of registers from
the cache where the minimum register is greater than the maximum
register, and doing so is likely to trigger bugs in the caches.  Reject
such invalid inputs.

Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regcache.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 774e9c9bf3c4..1447967ff00b 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -589,6 +589,9 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
 
 	trace_regcache_drop_region(map, min, max);
 
+	if (min > max)
+		return -EINVAL;
+
 	return map->cache_ops->drop(map, min, max);
 }
 EXPORT_SYMBOL_GPL(regcache_drop_region);

-- 
2.47.3

[PATCH 2/2] regcache: Add test for bounds checking of regcache drop requests

[Mark Brown]

Validate that regcache_drop_region() rejects regions with a minimum
greater than the maximum.

Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regmap-kunit.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/base/regmap/regmap-kunit.c b/drivers/base/regmap/regmap-kunit.c
index c78772b660d6..c948219f46a3 100644
--- a/drivers/base/regmap/regmap-kunit.c
+++ b/drivers/base/regmap/regmap-kunit.c
@@ -1347,6 +1347,26 @@ static void cache_drop(struct kunit *test)
 	KUNIT_EXPECT_MEMEQ(test, &data->vals[param->from_reg], rval, sizeof(rval));
 }
 
+static void cache_drop_min_max(struct kunit *test)
+{
+	const struct regmap_test_param *param = test->param_value;
+	struct regmap *map;
+	struct regmap_config config;
+	struct regmap_ram_data *data;
+
+	config = test_regmap_config;
+	config.num_reg_defaults = BLOCK_TEST_SIZE;
+
+	map = gen_regmap(test, &config, &data);
+	KUNIT_ASSERT_FALSE(test, IS_ERR(map));
+	if (IS_ERR(map))
+		return;
+
+	/* Drop some registers */
+	KUNIT_EXPECT_EQ(test, -EINVAL, regcache_drop_region(map, param->from_reg + 5,
+							    param->from_reg + 3));
+}
+
 static void cache_drop_with_non_contiguous_ranges(struct kunit *test)
 {
 	const struct regmap_test_param *param = test->param_value;
@@ -2253,6 +2273,7 @@ static struct kunit_case regmap_test_cases[] = {
 	KUNIT_CASE_PARAM(cache_sync_readonly, real_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_sync_patch, real_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop, sparse_cache_types_gen_params),
+	KUNIT_CASE_PARAM(cache_drop_min_max, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_with_non_contiguous_ranges, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_all_and_sync_marked_dirty, sparse_cache_types_gen_params),
 	KUNIT_CASE_PARAM(cache_drop_all_and_sync_no_defaults, sparse_cache_types_gen_params),

-- 
2.47.3