linux.git/drivers/base/regmap, branch v6.5-rc2

regmap-irq: Fix out-of-bounds access when allocating config buffers

2023-07-12T11:05:10+00:00

When allocating the 2D array for handling IRQ type registers in
regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix
with num_config_bases rows and num_config_regs columns.

This is currently handled by allocating a buffer to hold a pointer for
each row (i.e. num_config_bases). After that, the logic attempts to
allocate the memory required to hold the register configuration for
each row. However, instead of doing this allocation for each row
(i.e. num_config_bases allocations), the logic erroneously does this
allocation num_config_regs number of times.

This scenario can lead to out-of-bounds accesses when num_config_regs
is greater than num_config_bases. Fix this by updating the terminating
condition of the loop that allocates the memory for holding the register
configuration to allocate memory only for each row in the matrix.

Amit Pundir reported a crash that was occurring on his db845c device
due to memory corruption (see "Closes" tag for Amit's report). The KASAN
report below helped narrow it down to this issue:

[   14.033877][    T1] ==================================================================
[   14.042507][    T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364
[   14.050796][    T1] Write of size 8 at addr 06ffff8081021850 by task init/1

[   14.242004][    T1] The buggy address belongs to the object at ffffff8081021850
[   14.242004][    T1]  which belongs to the cache kmalloc-8 of size 8
[   14.255669][    T1] The buggy address is located 0 bytes inside of
[   14.255669][    T1]  8-byte region [ffffff8081021850, ffffff8081021858)

Fixes: faa87ce9196d ("regmap-irq: Introduce config registers for irq types")
Reported-by: Amit Pundir 
Closes: https://lore.kernel.org/all/CAMi1Hd04mu6JojT3y6wyN2YeVkPR5R3qnkKJ8iR8if_YByCn4w@mail.gmail.com/
Tested-by: John Stultz 
Tested-by: Amit Pundir  # tested on Dragonboard 845c
Cc: stable@vger.kernel.org # v6.0+
Cc: Aidan MacDonald 
Cc: Saravana Kannan 
Cc: Catalin Marinas 
Signed-off-by: "Isaac J. Manjarres" 
Link: https://lore.kernel.org/r/20230711193059.2480971-1-isaacmanjarres@google.com
Signed-off-by: Mark Brown

Merge tag 'regmap-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

2023-06-28T20:26:19+00:00

Pull regmap updates from Mark Brown:
 "Another busy release for regmap with the second half of the maple tree
  register cache implementation, there's some smaller optimisations that
  could be done but this should now be able to replace the rbtree cache
  for most devices.

  We also had a followup from Aidan MacDonald's refactoring of some of
  the regmap-irq interfaces, the conversion is complete so the old
  interfaces are removed. This means that even with the new features for
  the maple tree cache we'd have a nice negative diffstat were it not
  for the addition of a bunch more KUnit coverage.

  There's one GPIO patch in here, it was a dependency for a cleanup of
  an API in the regmap-irq code for which the gpio-104-dio-48e driver
  was the only user.

  Highlights:

   - The maple tree cache can now load in default values more
     efficiently, and is capabale of syncing multiple registers
     in a single write during cache sync

   - More KUnit coverage, including some coverage for raw I/O
     and a dummy RAM backed cache to support it

   - Removal of several old interfaces in regmap-irq now all
     users have been modernised"

* tag 'regmap-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: (23 commits)
  regmap: Allow reads from write only registers with the flat cache
  regmap: Drop early readability check
  regmap: Check for register readability before checking cache during read
  regmap: Add test to make sure we don't sync to read only registers
  regmap: Add a test case for write only registers
  regmap: Add test that writes to write only registers are prevented
  regmap: Add debugfs file for forcing field writes
  regmap: Don't check for changes in regcache_set_val()
  regmap: maple: Implement block sync for the maple tree cache
  regmap: Provide basic KUnit coverage for the raw register I/O
  regmap: Provide a ram backed regmap with raw support
  regmap: Add missing cache_only checks
  regmap: regmap-irq: Move handle_post_irq to before pm_runtime_put
  regmap: Load register defaults in blocks rather than register by register
  regmap: mmio: Allow passing an empty config->reg_stride
  regmap-irq: Drop backward compatibility for inverted mask/unmask
  regmap-irq: Minor adjustments to .handle_mask_sync()
  regmap-irq: Remove support for not_fixed_stride
  regmap-irq: Remove type registers
  regmap-irq: Remove virtual registers
  ...

regmap: spi-avmm: Fix regmap_bus max_raw_write

2023-06-20T20:31:08+00:00

The max_raw_write member of the regmap_spi_avmm_bus structure is defined
as:
	.max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT

SPI_AVMM_VAL_SIZE == 4 and MAX_WRITE_CNT == 1 so this results in a
maximum write transfer size of 4 bytes which provides only enough space to
transfer the address of the target register. It provides no space for the
value to be transferred. This bug became an issue (divide-by-zero in
_regmap_raw_write()) after the following was accepted into mainline:

commit 3981514180c9 ("regmap: Account for register length when chunking")

Change max_raw_write to include space (4 additional bytes) for both the
register address and value:

	.max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT

Fixes: 7f9fb67358a2 ("regmap: add Intel SPI Slave to AVMM Bus Bridge support")
Reviewed-by: Matthew Gerlach 
Signed-off-by: Russ Weight 
Link: https://lore.kernel.org/r/20230620202824.380313-1-russell.h.weight@intel.com
Signed-off-by: Mark Brown

regmap: Allow reads from write only registers with the flat cache

2023-06-19T11:59:41+00:00

The flat cache is intended for devices that need the lowest overhead so
doesn't track any sparseness.

Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230617-regmap-kunit-read-writeonly-flat-v1-1-efd3ed66dec6@kernel.org
Signed-off-by: Mark Brown

regmap: Drop early readability check

2023-06-16T11:56:13+00:00

We have some drivers that have a use case for cached write only
registers, doing read/modify/writes on read only registers in order to
work more easily with bitfields.  Go back to trying the cache before we
check if we can read from the device.

Fixes: eab5abdeb79f0 ("regmap: Check for register readability before checking cache during read")
Reported-by: Konrad Dybcio 
Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230615-regmap-drop-early-readability-v1-1-8135094362de@kernel.org
Signed-off-by: Mark Brown

regmap: Add KUnit tests for read/write checking

2023-06-14T17:35:13+00:00

Merge series from Mark Brown :

Since Takashi found an issue with maple tree syncing registers it
shouldn't do add some test cases that catch that case and some more
potential issues, ideally we'd run through the combination of
readability with all possible I/O calls but that's lifting for another
day.  We did find one issue with missing readability checks which will
be fixed separately.

regmap: Check for register readability before checking cache during read

2023-06-14T11:27:16+00:00

Ensure that we don't return a spurious cache hit for unreadable registers
(eg, with the flat cache which doesn't understand sparseness) by checking
for readability before we do a cache lookup.

Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230613-b4-regmap-check-readability-before-cache-v1-1-b144c0b01ed9@kernel.org
Signed-off-by: Mark Brown

regmap: Add test to make sure we don't sync to read only registers

2023-06-14T11:27:08+00:00

Ensure that a read only value in the register cache does not result in a
write during regcache_sync().

Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230613-regmap-kunit-read-write-v1-3-2db337c52827@kernel.org
Signed-off-by: Mark Brown

regmap: Add a test case for write only registers

2023-06-14T11:27:07+00:00

Validate that attempts to read from write only registers fail and don't
somehow trigger spurious hardware accesses.

Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230613-regmap-kunit-read-write-v1-2-2db337c52827@kernel.org
Signed-off-by: Mark Brown

regmap: Add test that writes to write only registers are prevented

2023-06-14T11:27:06+00:00

We should have error checking that verifies that writes to write only
registers are suppressed, verify that this happens as it should.

Signed-off-by: Mark Brown 
Link: https://lore.kernel.org/r/20230613-regmap-kunit-read-write-v1-1-2db337c52827@kernel.org
Signed-off-by: Mark Brown