Re: [PATCH] gpio: davinci: Fix potential buffer overflow

[Dan Carpenter]

On Thu, Mar 28, 2024 at 12:10:21PM +0300, Aleksandr Mishin wrote:
> In davinci_gpio_probe() accessing an element of array 'chips->regs' of size 5 and
> array 'offset_array' of size 5 can lead to a buffer overflow, since the index
> 'bank' can have an out of range value 63.
                                        ^^

Where does this 63 come from?  SVACE is a static analysis tool.  I would
have thought a static checker would say that 'bank' goes up to
UINT_MAX / 32.

This stuff comes from device tree though, so it looks fine to me.

Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <144>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <32>;
Documentation/devicetree/bindings/gpio/gpio-davinci.yaml:      ti,ngpio = <56>;
arch/arm/boot/dts/ti/davinci/da850.dtsi:                        ti,ngpio = <144>;

So it's fine.

I'm not the maintainer of this file so I don't know if adding a sanity
check makes sense but if we wanted to do that we'd have to add it to
davinci_gpio_get_pdata().  Otherwise it would have already had a buffer
overflow earlier in the probe function when we do:

drivers/gpio/gpio-davinci.c
   223          if (pdata->gpio_unbanked)
   224                  nirq = pdata->gpio_unbanked;
   225          else
   226                  nirq = DIV_ROUND_UP(ngpio, 16);
   227  
   228          chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL);
   229          if (!chips)
   230                  return -ENOMEM;
   231  
   232          gpio_base = devm_platform_ioremap_resource(pdev, 0);
   233          if (IS_ERR(gpio_base))
   234                  return PTR_ERR(gpio_base);
   235  
   236          for (i = 0; i < nirq; i++) {
   237                  chips->irqs[i] = platform_get_irq(pdev, i);
                                   ^^^

   238                  if (chips->irqs[i] < 0)
   239                          return chips->irqs[i];
   240          }

regards,
dan carpenter