[PATCH] cache: sifive: Add bounds check for interrupt count in probe

[zhangjiao2]

From: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>

The sifive_ccache_probe() function uses platform_irq_count() to
determine the number of interrupts and then iterates over them,
storing each IRQ number into the global g_irq[] array which has
a fixed size of SIFIVE_CCACHE_MAX_ECCINTR (4).

If the device tree defines more than 4 interrupts for the cache
controller, the loop writes past the end of g_irq[], causing a
buffer overflow in kernel BSS memory. This could corrupt adjacent
global variables and potentially be exploited for privilege
escalation.

Add a bounds check to reject configurations where intr_num exceeds
SIFIVE_CCACHE_MAX_ECCINTR.

Signed-off-by: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/cache/sifive_ccache.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/cache/sifive_ccache.c b/drivers/cache/sifive_ccache.c
index 2acb8bdf06d5..5272c4efe607 100644
--- a/drivers/cache/sifive_ccache.c
+++ b/drivers/cache/sifive_ccache.c
@@ -265,6 +265,11 @@ static int sifive_ccache_probe(struct platform_device *pdev)
 	if (!intr_num)
 		return dev_err_probe(dev, -ENODEV, "No interrupts property\n");
 
+	if (intr_num > SIFIVE_CCACHE_MAX_ECCINTR)
+		return dev_err_probe(dev, -EINVAL,
+				     "Too many interrupts: %d (max %d)\n",
+				     intr_num, SIFIVE_CCACHE_MAX_ECCINTR);
+
 	for (int i = 0; i < intr_num; i++) {
 		if (i == DATA_UNCORR && (quirks & QUIRK_BROKEN_DATA_UNCORR))
 			continue;
-- 
2.33.0