[PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

ahci_dwc_init_dmacr() reads the "reg" property of every available child
node and uses it directly as a port number, both to compute the port
MMIO base and as an index into dpriv->dmacr[], which has AHCI_MAX_PORTS
entries.  ahci_platform_get_resources(), which runs earlier, checks the
same property against hpriv->nports and skips invalid child nodes, but
this second walk does not.

A device tree that describes one valid port and one port with a "reg"
value above AHCI_MAX_PORTS therefore makes the driver write past
dpriv->dmacr[] and access MMIO beyond the mapped region.  Apply the same
check as the resource loop and skip invalid child nodes with a warning.

Fixes: 33629d35090f ("ata: ahci: Add DWC AHCI SATA controller support")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
Tested on 7.3.0-next-20261030 (QEMU/TCG arm64 guest, KASAN) with a
TEST-ONLY device tree.  The DT adds a snps,dwc-ahci node with port@0
and port@100; the TEST-ONLY printk hook in ahci_dwc_init_dmacr() is
applied to both kernels.  mem=512M keeps the fake MMIO window outside
System RAM.

  unpatched                            patched
  KASAN: slab-out-of-bounds            no KASAN report
  in ahci_dwc_probe                    port 100 skipped, boot

diff --git a/drivers/ata/ahci_dwc.c b/drivers/ata/ahci_dwc.c
index feb8a8539b8e..9094eb19e19f 100644
--- a/drivers/ata/ahci_dwc.c
+++ b/drivers/ata/ahci_dwc.c
@@ -225,6 +225,12 @@ static int ahci_dwc_init_dmacr(struct ahci_host_priv *hpriv)
 		if (of_property_read_u32(child, "reg", &port))
 			return -EINVAL;
 
+		if (port >= hpriv->nports) {
+			dev_warn(&dpriv->pdev->dev,
+				 "invalid port number %u\n", port);
+			continue;
+		}
+
 		port_mmio = __ahci_port_base(hpriv, port);
 		dmacr = readl(port_mmio + AHCI_DWC_PORT_DMACR);

Re: [PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[Damien Le Moal]

On 11/4/26 23:13, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> ahci_dwc_init_dmacr() reads the "reg" property of every available child
> node and uses it directly as a port number, both to compute the port
> MMIO base and as an index into dpriv->dmacr[], which has AHCI_MAX_PORTS
> entries.  ahci_platform_get_resources(), which runs earlier, checks the
> same property against hpriv->nports and skips invalid child nodes, but
> this second walk does not.
> 
> A device tree that describes one valid port and one port with a "reg"
> value above AHCI_MAX_PORTS therefore makes the driver write past
> dpriv->dmacr[] and access MMIO beyond the mapped region.  Apply the same
> check as the resource loop and skip invalid child nodes with a warning.
> 
> Fixes: 33629d35090f ("ata: ahci: Add DWC AHCI SATA controller support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Looks OK.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research

Re: [PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[Niklas Cassel]

On Wed, Nov 04, 2026 at 10:13:18PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> ahci_dwc_init_dmacr() reads the "reg" property of every available child
> node and uses it directly as a port number, both to compute the port
> MMIO base and as an index into dpriv->dmacr[], which has AHCI_MAX_PORTS
> entries.  ahci_platform_get_resources(), which runs earlier, checks the
> same property against hpriv->nports and skips invalid child nodes, but
> this second walk does not.
> 
> A device tree that describes one valid port and one port with a "reg"
> value above AHCI_MAX_PORTS therefore makes the driver write past
> dpriv->dmacr[] and access MMIO beyond the mapped region.  Apply the same
> check as the resource loop and skip invalid child nodes with a warning.
> 
> Fixes: 33629d35090f ("ata: ahci: Add DWC AHCI SATA controller support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> ---
> Tested on 7.3.0-next-20261030 (QEMU/TCG arm64 guest, KASAN) with a
> TEST-ONLY device tree.  The DT adds a snps,dwc-ahci node with port@0
> and port@100; the TEST-ONLY printk hook in ahci_dwc_init_dmacr() is
> applied to both kernels.  mem=512M keeps the fake MMIO window outside
> System RAM.
> 
>   unpatched                            patched
>   KASAN: slab-out-of-bounds            no KASAN report
>   in ahci_dwc_probe                    port 100 skipped, boot
> 
> diff --git a/drivers/ata/ahci_dwc.c b/drivers/ata/ahci_dwc.c
> index feb8a8539b8e..9094eb19e19f 100644
> --- a/drivers/ata/ahci_dwc.c
> +++ b/drivers/ata/ahci_dwc.c
> @@ -225,6 +225,12 @@ static int ahci_dwc_init_dmacr(struct ahci_host_priv *hpriv)
>  		if (of_property_read_u32(child, "reg", &port))
>  			return -EINVAL;
>  
> +		if (port >= hpriv->nports) {
> +			dev_warn(&dpriv->pdev->dev,
> +				 "invalid port number %u\n", port);
> +			continue;
> +		}

Again, this warning is reduntant, as it is already printed by
ahci_platform_get_resources().

Perhaps:
--- a/drivers/ata/ahci_dwc.c
+++ b/drivers/ata/ahci_dwc.c
@@ -225,6 +225,10 @@ static int ahci_dwc_init_dmacr(struct ahci_host_priv *hpriv)
             if (of_property_read_u32(child, "reg", &port))
                     return -EINVAL;

+            /* Already reported by ahci_platform_get_resources() */
+            if (port >= hpriv->nports)
+                    continue;
+
             port_mmio = __ahci_port_base(hpriv, port);


And please send this as a patch 2/2 with the libahci_platform patch as a
patch 1/2.


Kind regards,
Niklas

Re: [PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[shao.mingyin]

On Mon, Nov 09, 2026 at 04:19:56PM +0100, Niklas Cassel wrote:
> Again, this warning is reduntant, as it is already printed by
> ahci_platform_get_resources().

Agreed, and thanks.  The KASAN run for this patch printed "invalid port
number 100" twice in a row, which is exactly the duplication you point
out; dropping the warning leaves only the skip, which is what the test
exercises.

> And please send this as a patch 2/2 with the libahci_platform patch as a
> patch 1/2.

Will do: 1/2 libahci_platform, 2/2 this one.  Since the code changes I
won't carry Damien's v1 Reviewed-by over; he is Cc'd.

Best,
Shao Mingyin

Re: [PATCH] ata: ahci_dwc: reject invalid device tree port numbers

[Niklas Cassel]

On Tue, Nov 10, 2026 at 12:02:34AM +0800, shao.mingyin@zte.com.cn wrote:
> On Mon, Nov 09, 2026 at 04:19:56PM +0100, Niklas Cassel wrote:
> > Again, this warning is reduntant, as it is already printed by
> > ahci_platform_get_resources().
> 
> Agreed, and thanks.  The KASAN run for this patch printed "invalid port
> number 100" twice in a row, which is exactly the duplication you point
> out; dropping the warning leaves only the skip, which is what the test
> exercises.
> 
> > And please send this as a patch 2/2 with the libahci_platform patch as a
> > patch 1/2.
> 
> Will do: 1/2 libahci_platform, 2/2 this one.  Since the code changes I
> won't carry Damien's v1 Reviewed-by over; he is Cc'd.

I think it is okay to keep his tag, since the only change is a dropped
warning.


Kind regards,
Niklas