[PATCH] ata: libahci_platform: reject invalid port numbers

[PATCH] ata: libahci_platform: reject invalid port numbers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

ahci_platform_get_firmware() reads the "reg" property of every child
node of the AHCI controller and uses the value as an index into
hpriv->saved_port_cap[], which has AHCI_MAX_PORTS (32) entries, without
checking it first.

ahci_platform_get_resources() checks the same property against
hpriv->nports, but only in its own loop, and hpriv->nports is itself
clamped to AHCI_MAX_PORTS.  A device tree describing a port with a
"reg" value of 32 or more therefore reaches
ahci_platform_get_firmware(), where the "hba-port-cap" property is then
written past the end of the array.  Values just above the end corrupt
the following fields of struct ahci_host_priv, larger ones write outside
of the devres allocation.

Apply the same validity check as the resource loop and skip such child
nodes.

Fixes: 18ee7c49f75b ("ata: ahci: Introduce firmware-specific caps initialization")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index ae342080556a..d7106ab9ff3d 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -434,6 +434,11 @@ static int ahci_platform_get_firmware(struct ahci_host_priv *hpriv,
 		if (of_property_read_u32(child, "reg", &port))
 			return -EINVAL;

+		if (port >= hpriv->nports) {
+			dev_warn(dev, "invalid port number %d\n", port);
+			continue;
+		}
+
 		if (!of_property_read_u32(child, "hba-port-cap", &hpriv->saved_port_cap[port]))
 			hpriv->saved_port_cap[port] &= PORT_CMD_CAP;
 	}

Re: [PATCH] ata: libahci_platform: reject invalid port numbers

[Niklas Cassel]

On Thu, Oct 29, 2026 at 07:01:11PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> ahci_platform_get_firmware() reads the "reg" property of every child
> node of the AHCI controller and uses the value as an index into
> hpriv->saved_port_cap[], which has AHCI_MAX_PORTS (32) entries, without
> checking it first.
> 
> ahci_platform_get_resources() checks the same property against
> hpriv->nports, but only in its own loop, and hpriv->nports is itself
> clamped to AHCI_MAX_PORTS.  A device tree describing a port with a
> "reg" value of 32 or more therefore reaches
> ahci_platform_get_firmware(), where the "hba-port-cap" property is then
> written past the end of the array.  Values just above the end corrupt
> the following fields of struct ahci_host_priv, larger ones write outside
> of the devres allocation.
> 
> Apply the same validity check as the resource loop and skip such child
> nodes.
> 
> Fixes: 18ee7c49f75b ("ata: ahci: Introduce firmware-specific caps initialization")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> ---
> diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
> index ae342080556a..d7106ab9ff3d 100644
> --- a/drivers/ata/libahci_platform.c
> +++ b/drivers/ata/libahci_platform.c
> @@ -434,6 +434,11 @@ static int ahci_platform_get_firmware(struct ahci_host_priv *hpriv,
>  		if (of_property_read_u32(child, "reg", &port))
>  			return -EINVAL;
> 
> +		if (port >= hpriv->nports) {
> +			dev_warn(dev, "invalid port number %d\n", port);

The warning is redundant.

ahci_platform_get_resources() already prints a warning for this.

So perhaps something like:

--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -434,6 +434,10 @@ static int ahci_platform_get_firmware(struct ahci_host_priv *hpriv,
             if (of_property_read_u32(child, "reg", &port))
                     return -EINVAL;

+            /* Already reported by ahci_platform_get_resources() */
+            if (port >= hpriv->nports)
+                    continue;
+
             if (!of_property_read_u32(child, "hba-port-cap", &hpriv->saved_port_cap[port]))
                     hpriv->saved_port_cap[port] &= PORT_CMD_CAP;



Kind regards,
Niklas