iio: cf_axi_dds: Prevent out-of-bounds debug register access

Make sure that when using the debug register access that registers outside of the mapped memory region are not accessed. Otherwise undefined behavior can occur. Signed-off-by: Lars-Peter Clausen <[email protected]>
analogdevicesinc · Apr 30, 2018 · 0c33f80 · 0c33f80
1 parent a1dba55
commit 0c33f80
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/drivers/iio/frequency/cf_axi_dds.c b/drivers/iio/frequency/cf_axi_dds.c
@@ -717,6 +717,11 @@ static int cf_axi_dds_reg_access(struct iio_dev *indio_dev,
 	if ((reg & ~DEBUGFS_DRA_PCORE_REG_MAGIC) > 0xFFFF)
 		return -EINVAL;
 
+	/* Check that the register is in range and aligned */
+	if (((reg & DEBUGFS_DRA_PCORE_REG_MAGIC) || st->standalone) &&
+	    ((reg & 0xffff) >= st->regs_size || (reg & 0x3)))
+		return -EINVAL;
+
 	if (st->dev_spi)
 		conv = to_converter(st->dev_spi);
 
@@ -1300,6 +1305,7 @@ static int cf_axi_dds_probe(struct platform_device *pdev)
 	st = iio_priv(indio_dev);
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	st->regs_size = resource_size(res);
 	st->regs = devm_ioremap(&pdev->dev, res->start, resource_size(res));
 	if (!st->regs) {
 		ret = -ENOMEM;

diff --git a/drivers/iio/frequency/cf_axi_dds.h b/drivers/iio/frequency/cf_axi_dds.h
@@ -213,6 +213,7 @@ struct cf_axi_dds_state {
 	bool			pl_dma_fifo_en;
 
 	struct iio_info		iio_info;
+	size_t			regs_size;
 	void __iomem		*regs;
 	void __iomem		*slave_regs;
 	void __iomem		*master_regs;