Re: [PATCH v2 1/2] ata: libahci_platform: reject invalid port numbers

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/11/11 0:03, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> ahci_platform_get_firmware() reads the "reg" property of every child
> node of the AHCI controller and uses the value as an index into
> hpriv->saved_port_cap[], which has AHCI_MAX_PORTS (32) entries, without
> checking it first.
> 
> ahci_platform_get_resources() checks the same property against
> hpriv->nports, but only in its own loop, and hpriv->nports is itself
> clamped to AHCI_MAX_PORTS.  A device tree describing a port with a
> "reg" value of 32 or more therefore reaches
> ahci_platform_get_firmware(), where the "hba-port-cap" property is then
> written past the end of the array.  Values just above the end corrupt
> the following fields of struct ahci_host_priv, larger ones write outside
> of the devres allocation.
> 
> Apply the same validity check as the resource loop and skip such child
> nodes.  That loop has already reported the invalid port number, so do
> not print a second warning.
> 
> Fixes: 18ee7c49f75b ("ata: ahci: Introduce firmware-specific caps initialization")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Looks OK.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research