RE: [PATCH 05/10] pinctrl: realtek: Prevent out-of-bounds access in rtd_pinctrl_find_config()

[Yu-Chun Lin [林祐君]]

> Several Realtek SoC pin configuration tables (such as rtd1319d_iso_configs,
> rtd1619b_iso_configs, and the rtd1625 config tables) omit trailing pins that do
> not support pin configuration, making data->info->num_configs smaller than
> data->info->num_pins.  Because rtd_pinctrl_find_config() indexes
> data->info->configs[pin] without checking data->info->num_configs, requesting
> pin configuration on a trailing pin reads out-of-bounds memory.
> 
> Check that pin is less than data->info->num_configs before indexing
> data->info->configs[].
> 
> Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek
> DHC RTD SoCs")
> Closes:
> https://sashiko.dev/#/bug/linux-60e13761-fd9e-4fd3-826a-47344f36d4fa
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>

Reviewed-by: Yu-Chun Lin <eleanor.lin@xxxxxxxxxxx>

> ---
>  drivers/pinctrl/realtek/pinctrl-rtd.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/pinctrl/realtek/pinctrl-rtd.c
> b/drivers/pinctrl/realtek/pinctrl-rtd.c
> index 60222339726b..2b877099ec85 100644
> --- a/drivers/pinctrl/realtek/pinctrl-rtd.c
> +++ b/drivers/pinctrl/realtek/pinctrl-rtd.c
> @@ -252,6 +252,9 @@ static const struct pinctrl_pin_desc  static const struct
> rtd_pin_config_desc
>         *rtd_pinctrl_find_config(struct rtd_pinctrl *data, unsigned int pin)
> {
> +       if (pin >= data->info->num_configs)
> +               return NULL;
> +
>         if (data->info->configs[pin].name)
>                 return &data->info->configs[pin];
> 
> --
> 2.56.0.385.gac671c819a-goog