iio: cf_axi_adc: Prevent out-of-bounds debug register access

Make sure that when using the debug register access that registers outside of the mapped memory region are not accessed. Otherwise undefined behavior can occur. Signed-off-by: Lars-Peter Clausen <[email protected]>
analogdevicesinc · Apr 30, 2018 · a1dba55 · a1dba55
1 parent 9b924ae
commit a1dba55
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/drivers/iio/adc/cf_axi_adc.h b/drivers/iio/adc/cf_axi_adc.h
@@ -202,6 +202,7 @@ struct axiadc_state {
 	struct device 			*dev_spi;
 	struct iio_info			iio_info;
 	struct clk 			*clk;
+	size_t				regs_size;
 	void __iomem			*regs;
 	void __iomem			*slave_regs;
 	unsigned				max_usr_channel;

diff --git a/drivers/iio/adc/cf_axi_adc_core.c b/drivers/iio/adc/cf_axi_adc_core.c
@@ -199,6 +199,11 @@ static int axiadc_reg_access(struct iio_dev *indio_dev,
 	struct axiadc_state *st = iio_priv(indio_dev);
 	int ret;
 
+	/* Check that the register is in range and aligned */
+	if ((reg & DEBUGFS_DRA_PCORE_REG_MAGIC) &&
+	    ((reg & 0xffff) >= st->regs_size || (reg & 0x3)))
+		return -EINVAL;
+
 	mutex_lock(&indio_dev->mlock);
 
 	if (!(reg & DEBUGFS_DRA_PCORE_REG_MAGIC)) {
@@ -772,6 +777,7 @@ static int axiadc_probe(struct platform_device *pdev)
 	st = iio_priv(indio_dev);
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	st->regs_size = resource_size(mem);
 	st->regs = devm_ioremap_resource(&pdev->dev, mem);
 	if (IS_ERR(st->regs))
 		return PTR_ERR(st->regs);