[PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

ahci_dwc_init_dmacr() reads the "reg" property of every available child
node and uses it directly as a port number, both to compute the port
MMIO base and as an index into dpriv->dmacr[], which has AHCI_MAX_PORTS
entries.  ahci_platform_get_resources(), which runs earlier, checks the
same property against hpriv->nports and skips invalid child nodes, but
this second walk does not.

A device tree that describes one valid port and one port with a "reg"
value above AHCI_MAX_PORTS therefore makes the driver write past
dpriv->dmacr[] and access MMIO beyond the mapped region.  Apply the same
check as the resource loop and skip invalid child nodes with a warning.

Fixes: 33629d35090f ("ata: ahci: Add DWC AHCI SATA controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
Tested on 7.3.0-next-20261030 (QEMU/TCG arm64 guest, KASAN) with a
TEST-ONLY device tree.  The DT adds a snps,dwc-ahci node with port@0
and port@100; the TEST-ONLY printk hook in ahci_dwc_init_dmacr() is
applied to both kernels.  mem=512M keeps the fake MMIO window outside
System RAM.

  unpatched                            patched
  KASAN: slab-out-of-bounds            no KASAN report
  in ahci_dwc_probe                    port 100 skipped, boot

diff --git a/drivers/ata/ahci_dwc.c b/drivers/ata/ahci_dwc.c
index feb8a8539b8e..9094eb19e19f 100644
--- a/drivers/ata/ahci_dwc.c
+++ b/drivers/ata/ahci_dwc.c
@@ -225,6 +225,12 @@ static int ahci_dwc_init_dmacr(struct ahci_host_priv *hpriv)
 		if (of_property_read_u32(child, "reg", &port))
 			return -EINVAL;
 
+		if (port >= hpriv->nports) {
+			dev_warn(&dpriv->pdev->dev,
+				 "invalid port number %u\n", port);
+			continue;
+		}
+
 		port_mmio = __ahci_port_base(hpriv, port);
 		dmacr = readl(port_mmio + AHCI_DWC_PORT_DMACR);

Re: [PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[Damien Le Moal]

On 11/4/26 23:13, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> ahci_dwc_init_dmacr() reads the "reg" property of every available child
> node and uses it directly as a port number, both to compute the port
> MMIO base and as an index into dpriv->dmacr[], which has AHCI_MAX_PORTS
> entries.  ahci_platform_get_resources(), which runs earlier, checks the
> same property against hpriv->nports and skips invalid child nodes, but
> this second walk does not.
> 
> A device tree that describes one valid port and one port with a "reg"
> value above AHCI_MAX_PORTS therefore makes the driver write past
> dpriv->dmacr[] and access MMIO beyond the mapped region.  Apply the same
> check as the resource loop and skip invalid child nodes with a warning.
> 
> Fixes: 33629d35090f ("ata: ahci: Add DWC AHCI SATA controller support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Looks OK.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research