[PATCH v2 1/2] ata: libahci_platform: reject invalid port numbers

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

ahci_platform_get_firmware() reads the "reg" property of every child
node of the AHCI controller and uses the value as an index into
hpriv->saved_port_cap[], which has AHCI_MAX_PORTS (32) entries, without
checking it first.

ahci_platform_get_resources() checks the same property against
hpriv->nports, but only in its own loop, and hpriv->nports is itself
clamped to AHCI_MAX_PORTS.  A device tree describing a port with a
"reg" value of 32 or more therefore reaches
ahci_platform_get_firmware(), where the "hba-port-cap" property is then
written past the end of the array.  Values just above the end corrupt
the following fields of struct ahci_host_priv, larger ones write outside
of the devres allocation.

Apply the same validity check as the resource loop and skip such child
nodes.  That loop has already reported the invalid port number, so do
not print a second warning.

Fixes: 18ee7c49f75b ("ata: ahci: Introduce firmware-specific caps initialization")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

---
v2:
- Do not print a warning for the invalid port number: the resource loop
  has already reported it (Niklas Cassel).  The validity check itself
  is unchanged.
- Send as 1/2, with the ahci_dwc patch as 2/2.
- v1: https://lore.kernel.org/all/20261029190111138tS0yRo0lL1zJZ_IutobE1@xxxxxxxxxx/
---
 drivers/ata/libahci_platform.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index ae342080556a..0ffa4486de77 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -434,6 +434,10 @@ static int ahci_platform_get_firmware(struct ahci_host_priv *hpriv,
 		if (of_property_read_u32(child, "reg", &port))
 			return -EINVAL;
 
+		/* Already reported by ahci_platform_get_resources() */
+		if (port >= hpriv->nports)
+			continue;
+
 		if (!of_property_read_u32(child, "hba-port-cap", &hpriv->saved_port_cap[port]))
 			hpriv->saved_port_cap[port] &= PORT_CMD_CAP;
 	}
-- 
2.27.0