* [PATCH 1/2] regcache: Validate bounds of regcache drop requests
2026-10-26 23:32 [PATCH 0/2] regcache: Validate bounds of regcache drop requests Mark Brown
@ 2026-10-26 23:32 ` Mark Brown
2026-10-26 23:32 ` [PATCH 2/2] regcache: Add test for bounds checking " Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Mark Brown @ 2026-10-26 23:32 UTC (permalink / raw)
To: Mark Brown; +Cc: linux-kernel
It is not valid for a caller to try to drop a range of registers from
the cache where the minimum register is greater than the maximum
register, and doing so is likely to trigger bugs in the caches. Reject
such invalid inputs.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
drivers/base/regmap/regcache.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 774e9c9bf3c4..1447967ff00b 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -589,6 +589,9 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
trace_regcache_drop_region(map, min, max);
+ if (min > max)
+ return -EINVAL;
+
return map->cache_ops->drop(map, min, max);
}
EXPORT_SYMBOL_GPL(regcache_drop_region);
--
2.47.3
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 2/2] regcache: Add test for bounds checking of regcache drop requests
2026-10-26 23:32 [PATCH 0/2] regcache: Validate bounds of regcache drop requests Mark Brown
2026-10-26 23:32 ` [PATCH 1/2] " Mark Brown
@ 2026-10-26 23:32 ` Mark Brown
1 sibling, 0 replies; 3+ messages in thread
From: Mark Brown @ 2026-10-26 23:32 UTC (permalink / raw)
To: Mark Brown; +Cc: linux-kernel
Validate that regcache_drop_region() rejects regions with a minimum
greater than the maximum.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
drivers/base/regmap/regmap-kunit.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/base/regmap/regmap-kunit.c b/drivers/base/regmap/regmap-kunit.c
index c78772b660d6..c948219f46a3 100644
--- a/drivers/base/regmap/regmap-kunit.c
+++ b/drivers/base/regmap/regmap-kunit.c
@@ -1347,6 +1347,26 @@ static void cache_drop(struct kunit *test)
KUNIT_EXPECT_MEMEQ(test, &data->vals[param->from_reg], rval, sizeof(rval));
}
+static void cache_drop_min_max(struct kunit *test)
+{
+ const struct regmap_test_param *param = test->param_value;
+ struct regmap *map;
+ struct regmap_config config;
+ struct regmap_ram_data *data;
+
+ config = test_regmap_config;
+ config.num_reg_defaults = BLOCK_TEST_SIZE;
+
+ map = gen_regmap(test, &config, &data);
+ KUNIT_ASSERT_FALSE(test, IS_ERR(map));
+ if (IS_ERR(map))
+ return;
+
+ /* Drop some registers */
+ KUNIT_EXPECT_EQ(test, -EINVAL, regcache_drop_region(map, param->from_reg + 5,
+ param->from_reg + 3));
+}
+
static void cache_drop_with_non_contiguous_ranges(struct kunit *test)
{
const struct regmap_test_param *param = test->param_value;
@@ -2253,6 +2273,7 @@ static struct kunit_case regmap_test_cases[] = {
KUNIT_CASE_PARAM(cache_sync_readonly, real_cache_types_gen_params),
KUNIT_CASE_PARAM(cache_sync_patch, real_cache_types_gen_params),
KUNIT_CASE_PARAM(cache_drop, sparse_cache_types_gen_params),
+ KUNIT_CASE_PARAM(cache_drop_min_max, sparse_cache_types_gen_params),
KUNIT_CASE_PARAM(cache_drop_with_non_contiguous_ranges, sparse_cache_types_gen_params),
KUNIT_CASE_PARAM(cache_drop_all_and_sync_marked_dirty, sparse_cache_types_gen_params),
KUNIT_CASE_PARAM(cache_drop_all_and_sync_no_defaults, sparse_cache_types_gen_params),
--
2.47.3
^ permalink raw reply [flat|nested] 3+ messages in thread