[PATCH] ata: libahci_platform: reject invalid port numbers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

ahci_platform_get_firmware() reads the "reg" property of every child
node of the AHCI controller and uses the value as an index into
hpriv->saved_port_cap[], which has AHCI_MAX_PORTS (32) entries, without
checking it first.

ahci_platform_get_resources() checks the same property against
hpriv->nports, but only in its own loop, and hpriv->nports is itself
clamped to AHCI_MAX_PORTS.  A device tree describing a port with a
"reg" value of 32 or more therefore reaches
ahci_platform_get_firmware(), where the "hba-port-cap" property is then
written past the end of the array.  Values just above the end corrupt
the following fields of struct ahci_host_priv, larger ones write outside
of the devres allocation.

Apply the same validity check as the resource loop and skip such child
nodes.

Fixes: 18ee7c49f75b ("ata: ahci: Introduce firmware-specific caps initialization")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index ae342080556a..d7106ab9ff3d 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -434,6 +434,11 @@ static int ahci_platform_get_firmware(struct ahci_host_priv *hpriv,
 		if (of_property_read_u32(child, "reg", &port))
 			return -EINVAL;

+		if (port >= hpriv->nports) {
+			dev_warn(dev, "invalid port number %d\n", port);
+			continue;
+		}
+
 		if (!of_property_read_u32(child, "hba-port-cap", &hpriv->saved_port_cap[port]))
 			hpriv->saved_port_cap[port] &= PORT_CMD_CAP;
 	}