[PATCH] regcache: maple: Don't overflow the register number when inserting

[PATCH] regcache: maple: Don't overflow the register number when inserting

[Mark Brown]

When inserting a previously uncached register into the maple cache we
check for adjacent blocks of registers above and below the register
number we are inserting and merge there.  Currently we check for reg - 1
and reg + 1 without worrying about if reg is 0 or UINT_MAX, meaning that
the register number will overflow and we could consider a block at the
other extremity of possible register numbers adjacent.  Avoid doing this
by clamping to 0 and UINT_MAX, if we do this then our search for an
adjacent block will fail as we will be looking for the register number
we are trying to insert.

The current behaviour means that in the event that we do attempt to
add 0 and merge it with a block at UINT_MAX kmalloc_array() rejects the
allocation for being absurdly large, this results in us failing the
write.  Such register maps are very unlikely due to the normal patterns
of register design and the fact that register numbers usually have less
bits than an int.

Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regcache-maple.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
index 16e488da5f23..9bc217b1e6f9 100644
--- a/drivers/base/regmap/regcache-maple.c
+++ b/drivers/base/regmap/regcache-maple.c
@@ -41,7 +41,7 @@ static int regcache_maple_write(struct regmap *map, unsigned int reg,
 	struct maple_tree *mt = map->cache;
 	MA_STATE(mas, mt, reg, reg);
 	unsigned long *entry, *upper, *lower;
-	unsigned long index, last;
+	unsigned long index, last, lower_reg, upper_reg;
 	size_t lower_sz, upper_sz;
 	int ret;
 
@@ -54,18 +54,33 @@ static int regcache_maple_write(struct regmap *map, unsigned int reg,
 		return 0;
 	}
 
-	/* Any adjacent entries to extend/merge? */
-	mas_set_range(&mas, reg - 1, reg + 1);
+	/* Avoid overflowing and wrapping */
+	if (reg != 0)
+		lower_reg = reg - 1;
+	else
+		lower_reg = reg;
+
+	if (reg != UINT_MAX)
+		upper_reg = reg + 1;
+	else
+		upper_reg = reg;
+
+	/*
+	 * Any adjacent entries to extend/merge?  If we are here then
+	 * reg won't exist so if we clamped lower_reg or upper_reg we
+	 * won't get anything from mas_find().
+	 */
+	mas_set_range(&mas, lower_reg, upper_reg);
 	index = reg;
 	last = reg;
 
-	lower = mas_find(&mas, reg - 1);
+	lower = mas_find(&mas, lower_reg);
 	if (lower) {
 		index = mas.index;
 		lower_sz = (mas.last - mas.index + 1) * sizeof(unsigned long);
 	}
 
-	upper = mas_find(&mas, reg + 1);
+	upper = mas_find(&mas, upper_reg);
 	if (upper) {
 		last = mas.last;
 		upper_sz = (mas.last - mas.index + 1) * sizeof(unsigned long);

---
base-commit: 2dee91ee94eec85d09c13c7ca83e3005906d3732
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.4
change-id: 20261026-regmap-maple-bounds-bc3075fb7a41

Best regards,
--  
Mark Brown <broonie@kernel.org>