Re: [PATCH] qe_ic: fix a buffer overflow error and add check elsewhere

[Thomas Gleixner]

On Thu, 21 Jan 2016, Zhao Qiang wrote:

> 127 is the theoretical up boundary of QEIC number,
> in fact there only be 44 qe_ic_info now.
> add check to overflow for qe_ic_info

How do you trigger that overflow? The above does not explain WHY we need these
checks.

> diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
> index 5419527..90c00b7 100644
> --- a/drivers/soc/fsl/qe/qe_ic.c
> +++ b/drivers/soc/fsl/qe/qe_ic.c

Sigh. Another dump ground for SOC stuff? irq chip drivers belong into
drivers/irqchip.

Thanks,

tglx
___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev

Re: [PATCH] qe_ic: fix a buffer overflow error and add check elsewhere

[Scott Wood]

On Tue, 2016-01-26 at 18:31 +0100, Thomas Gleixner wrote:
> On Thu, 21 Jan 2016, Zhao Qiang wrote:
> 
> > 127 is the theoretical up boundary of QEIC number,
> > in fact there only be 44 qe_ic_info now.
> > add check to overflow for qe_ic_info
> 
> How do you trigger that overflow? The above does not explain WHY we need
> these
> checks.

The check in qe_ic_host_map can be triggered by bad data in a device tree.

The set_priority functions do not appear to be used at all.

> 
> > diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
> > index 5419527..90c00b7 100644
> > --- a/drivers/soc/fsl/qe/qe_ic.c
> > +++ b/drivers/soc/fsl/qe/qe_ic.c
> 
> Sigh. Another dump ground for SOC stuff?

Another?  Where are the others, besides arch?

>  irq chip drivers belong into drivers/irqchip.

Yes.  This stuff was recently moved out of arch/powerpc to work toward being
able to use it on ARM.  I'm expecting followup patches to move things like
this that belong elsewhere.

-Scott

___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev

Re: [PATCH] qe_ic: fix a buffer overflow error and add check elsewhere

[Leo Li]

On Thu, Jan 21, 2016 at 9:06 AM, Zhao Qiang  wrote:
> 127 is the theoretical up boundary of QEIC number,
> in fact there only be 44 qe_ic_info now.
> add check to overflow for qe_ic_info
>
> Signed-off-by: Zhao Qiang 

Acked-by: Li Yang 

Regards,
Leo
___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev

[PATCH] qe_ic: fix a buffer overflow error and add check elsewhere

[Zhao Qiang]

127 is the theoretical up boundary of QEIC number,
in fact there only be 44 qe_ic_info now.
add check to overflow for qe_ic_info

Signed-off-by: Zhao Qiang 
---
 drivers/soc/fsl/qe/qe_ic.c | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
index 5419527..90c00b7 100644
--- a/drivers/soc/fsl/qe/qe_ic.c
+++ b/drivers/soc/fsl/qe/qe_ic.c
@@ -261,6 +261,11 @@ static int qe_ic_host_map(struct irq_domain *h, unsigned 
int virq,
struct qe_ic *qe_ic = h->host_data;
struct irq_chip *chip;
 
+   if (hw >= ARRAY_SIZE(qe_ic_info)) {
+   pr_err("%s: Invalid hw irq number for QEIC\n", __func__);
+   return -EINVAL;
+   }
+
if (qe_ic_info[hw].mask == 0) {
printk(KERN_ERR "Can't map reserved IRQ\n");
return -EINVAL;
@@ -409,7 +414,8 @@ int qe_ic_set_priority(unsigned int virq, unsigned int 
priority)
 
if (priority > 8 || priority == 0)
return -EINVAL;
-   if (src > 127)
+   if (WARN_ONCE(src >= ARRAY_SIZE(qe_ic_info),
+ "%s: Invalid hw irq number for QEIC\n", __func__))
return -EINVAL;
if (qe_ic_info[src].pri_reg == 0)
return -EINVAL;
@@ -438,6 +444,9 @@ int qe_ic_set_high_priority(unsigned int virq, unsigned int 
priority, int high)
 
if (priority > 2 || priority == 0)
return -EINVAL;
+   if (WARN_ONCE(src >= ARRAY_SIZE(qe_ic_info),
+ "%s: Invalid hw irq number for QEIC\n", __func__))
+   return -EINVAL;
 
switch (qe_ic_info[src].pri_reg) {
case QEIC_CIPZCC:
-- 
2.1.0.27.g96db324

___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev