Commit c16ae609 authored by Antonio Borneo's avatar Antonio Borneo Committed by Marc Zyngier
Browse files

irqchip/stm32-exti: Prevent illegal read due to unbounded DT value 



The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips
reading outside the array boundary.

Check the value of hwirq before using it.

Signed-off-by: default avatarAntonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20220606162757.415354-4-antonio.borneo@foss.st.com
parent f8b3eb42

drivers/irqchip/irq-stm32-exti.c

+3 −0
Original line number Diff line number Diff line
@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm, 
	int bank;



	hwirq = fwspec->param[0];

	if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)

		return -EINVAL;



	bank  = hwirq / IRQS_PER_BANK;

	chip_data = &host_data->chips_data[bank];