Re: [PATCH 19/28] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler()

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() enables all 32 interrupt bits via SE_INT_ALL
> (0xffffffff), and se_irq_handler() uses the set bit index from the
> 32-bit status register directly to index se->engines, which only holds
> SE_ENGINE_MAX (16) entries.  Any interrupt bit asserted at index 16 or
> above triggers an out-of-bounds access on se->engines.
>
> Restrict SE_INT_ALL to GENMASK(SE_ENGINE_MAX - 1, 0) and bounds-check
> the bit index against SE_ENGINE_MAX before completing the engine in
> se_irq_handler().
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-bc962408-5c42-40af-8111-a8463a05ccdf
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>

Reviewed-by: Qunqin Zhao <zhaoqunqin@xxxxxxxxxxx>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c       | 3 ++-
>  include/linux/mfd/loongson-se.h | 7 ++++---
>  2 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index 187ebbed0422..10af13c3b7cc 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -158,7 +158,8 @@ static irqreturn_t se_irq_handler(int irq, void *dev_id)
>  	/* For engines */
>  	while (int_status) {
>  		id = __ffs(int_status);
> -		complete(&se->engines[id].completion);
> +		if (id < SE_ENGINE_MAX)
> +			complete(&se->engines[id].completion);
>  		int_status &= ~BIT(id);
>  		writel(BIT(id), se->base + SE_S2LINT_CL);
>  	}
> diff --git a/include/linux/mfd/loongson-se.h b/include/linux/mfd/loongson-se.h
> index 07afa0c2524d..2d0a8b1e5c9e 100644
> --- a/include/linux/mfd/loongson-se.h
> +++ b/include/linux/mfd/loongson-se.h
> @@ -4,6 +4,8 @@
>  #ifndef __MFD_LOONGSON_SE_H__
>  #define __MFD_LOONGSON_SE_H__
>  
> +#include <linux/bits.h>
> +
>  #define LOONGSON_ENGINE_CMD_TIMEOUT_US	10000
>  #define SE_SEND_CMD_REG			0x0
>  #define SE_SEND_CMD_REG_LEN		0x8
> @@ -18,10 +20,9 @@
>  #define SE_L2SINT_STAT			0x98
>  #define SE_L2SINT_SET			0xa0
>  
> -#define SE_INT_ALL			0xffffffff
> -#define SE_INT_CONTROLLER		BIT(0)
> -
>  #define SE_ENGINE_MAX			16
> +#define SE_INT_ALL			GENMASK(SE_ENGINE_MAX - 1, 0)
> +#define SE_INT_CONTROLLER		BIT(0)
>  #define SE_ENGINE_RNG			1
>  #define SE_CMD_RNG			0x100
>