[PATCH 3/6] platform/x86/intel/pmt/discovery: Validate feature id before use

[David E. Box]

pmt_feature_get_disc_table() reads the feature id from device MMIO and
uses it in the duplicate check, as BIT(disc_tbl->id) and as an index
into pmt_feature_names[], before pmt_feature_id_is_valid() is called.

The id is a 32-bit field, so a malformed table can supply a shift count of
BITS_PER_LONG or more, which is undefined. Validate the id before it is
used.

Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Signed-off-by: David E. Box <david.e.box@xxxxxxxxxxxxxxx>
---
 drivers/platform/x86/intel/pmt/discovery.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/intel/pmt/discovery.c b/drivers/platform/x86/intel/pmt/discovery.c
index 143d2b3be562..24ba7211e59d 100644
--- a/drivers/platform/x86/intel/pmt/discovery.c
+++ b/drivers/platform/x86/intel/pmt/discovery.c
@@ -348,6 +348,10 @@ pmt_feature_get_disc_table(struct pmt_features_priv *priv,
 
 	devm_iounmap(priv->dev, disc_base);
 
+	/* The id is used as a bit position and array index below */
+	if (!pmt_feature_id_is_valid(disc_tbl->id))
+		return SKIP_FEATURE;
+
 	if (priv->mask & BIT(disc_tbl->id))
 		return dev_err_probe(priv->dev, -EINVAL, "Duplicate feature: %s\n",
 				     pmt_feature_names[disc_tbl->id]);
@@ -363,9 +367,6 @@ pmt_feature_get_disc_table(struct pmt_features_priv *priv,
 	if (disc_tbl->version > MAX_FEATURE_VERSION)
 		return SKIP_FEATURE;
 
-	if (!pmt_feature_id_is_valid(disc_tbl->id))
-		return SKIP_FEATURE;
-
 	priv->mask |= BIT(disc_tbl->id);
 
 	return 0;
-- 
2.43.0