[PATCH 05/10] pinctrl: realtek: Prevent out-of-bounds access in rtd_pinctrl_find_config()

[Lee Jones <lee@kernel.org>]

Several Realtek SoC pin configuration tables (such as rtd1319d_iso_configs,
rtd1619b_iso_configs, and the rtd1625 config tables) omit trailing pins
that do not support pin configuration, making data->info->num_configs
smaller than data->info->num_pins.  Because rtd_pinctrl_find_config()
indexes data->info->configs[pin] without checking data->info->num_configs,
requesting pin configuration on a trailing pin reads out-of-bounds memory.

Check that pin is less than data->info->num_configs before indexing
data->info->configs[].

Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs")
Closes: https://sashiko.dev/#/bug/linux-60e13761-fd9e-4fd3-826a-47344f36d4fa
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/pinctrl/realtek/pinctrl-rtd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pinctrl/realtek/pinctrl-rtd.c b/drivers/pinctrl/realtek/pinctrl-rtd.c
index 60222339726b..2b877099ec85 100644
--- a/drivers/pinctrl/realtek/pinctrl-rtd.c
+++ b/drivers/pinctrl/realtek/pinctrl-rtd.c
@@ -252,6 +252,9 @@ static const struct pinctrl_pin_desc
 static const struct rtd_pin_config_desc
 	*rtd_pinctrl_find_config(struct rtd_pinctrl *data, unsigned int pin)
 {
+	if (pin >= data->info->num_configs)
+		return NULL;
+
 	if (data->info->configs[pin].name)
 		return &data->info->configs[pin];
 
-- 
2.56.0.385.gac671c819a-goog