[PATCH 19/28] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler()

[Lee Jones]

loongson_se_probe() enables all 32 interrupt bits via SE_INT_ALL
(0xffffffff), and se_irq_handler() uses the set bit index from the
32-bit status register directly to index se->engines, which only holds
SE_ENGINE_MAX (16) entries.  Any interrupt bit asserted at index 16 or
above triggers an out-of-bounds access on se->engines.

Restrict SE_INT_ALL to GENMASK(SE_ENGINE_MAX - 1, 0) and bounds-check
the bit index against SE_ENGINE_MAX before completing the engine in
se_irq_handler().

Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-bc962408-5c42-40af-8111-a8463a05ccdf
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/mfd/loongson-se.c       | 3 ++-
 include/linux/mfd/loongson-se.h | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 187ebbed0422..10af13c3b7cc 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -158,7 +158,8 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
 	/* For engines */
 	while (int_status) {
 		id = __ffs(int_status);
-		complete(&se->engines[id].completion);
+		if (id < SE_ENGINE_MAX)
+			complete(&se->engines[id].completion);
 		int_status &= ~BIT(id);
 		writel(BIT(id), se->base + SE_S2LINT_CL);
 	}
diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
index 07afa0c2524d..2d0a8b1e5c9e 100644
--- a/include/linux/mfd/loongson-se.h
+++ b/include/linux/mfd/loongson-se.h
@@ -4,6 +4,8 @@
 #ifndef __MFD_LOONGSON_SE_H__
 #define __MFD_LOONGSON_SE_H__
 
+#include <linux/bits.h>
+
 #define LOONGSON_ENGINE_CMD_TIMEOUT_US	10000
 #define SE_SEND_CMD_REG			0x0
 #define SE_SEND_CMD_REG_LEN		0x8
@@ -18,10 +20,9 @@
 #define SE_L2SINT_STAT			0x98
 #define SE_L2SINT_SET			0xa0
 
-#define SE_INT_ALL			0xffffffff
-#define SE_INT_CONTROLLER		BIT(0)
-
 #define SE_ENGINE_MAX			16
+#define SE_INT_ALL			GENMASK(SE_ENGINE_MAX - 1, 0)
+#define SE_INT_CONTROLLER		BIT(0)
 #define SE_ENGINE_RNG			1
 #define SE_CMD_RNG			0x100
 
-- 
2.56.0.218.g1ec904b173-goog