From patchwork Mon Mar 4 20:37:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1907882 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TpVr81XMpz23qm for ; Tue, 5 Mar 2024 07:37:43 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rhF3y-0004OM-AN; Mon, 04 Mar 2024 20:37:30 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rhF3s-0004O0-Bq for kernel-team@lists.ubuntu.com; Mon, 04 Mar 2024 20:37:24 +0000 Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id DACDE40DBC for ; Mon, 4 Mar 2024 20:37:22 +0000 (UTC) Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-68f95177e25so63748196d6.2 for ; Mon, 04 Mar 2024 12:37:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709584641; x=1710189441; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VmPaU8H7L+myR6LkVA7ucHnDxE1KzYCmwd5vtQltNnA=; b=DVv/VFIYMR9TT+sbXRTvH7oijEka/sgLY01f16M71KYA+higHhoDhUEntYwGbvcPuj +yeYJX39YgoasIEUjEwFfAns0aecfsR6blxMj3VKdU16qfKCiihDMY3vnFCBSaY4OZUk w4YezTl/5pQBTt3TEl1J4kKUCjy13lUjWtNxqRioapS+0hjJA1NnbbphnAFFDXKiUIdB 3647k9F2r9QxBnGnnpSo8k3pe/aqBdFf7t9vKdb8c0LkhSRE5whhgvDbZ99CqdHNjQ28 BGt9LtiBcx2ufyJurJpLJXNlT9e6XCS9YnJj6Ps+lqJBmxjOZjwfIoa0OGqVLDLdaaEh gVvQ== X-Gm-Message-State: AOJu0YzCgz+bniwzGYddbezBABJGpwJysQSN3cB+6XNjnE66nADGoysO h97YmrX2FJpKwncDc7Gm0nyIpjE4rMglkmsZGnPfXzmCwqyGxjp17RiBaIotMtu5ATYtbnXfC8E LqBSdqOeZyXotJ9ctm+d0jFBsQxWSpMg86sSbAWPGHJKwnC/piqINupWYQIQwk64UVEY4pEstbs EEOAAPEYYwUA== X-Received: by 2002:a05:6214:564b:b0:690:520d:783e with SMTP id mh11-20020a056214564b00b00690520d783emr9866916qvb.43.1709584641706; Mon, 04 Mar 2024 12:37:21 -0800 (PST) X-Google-Smtp-Source: AGHT+IEV1Hk0iS7qPJG0lBMg25cE7BtHNy8JASJ1fUg03f3KgfXJB08kSvEVfwskrmsjv16RKN4v0w== X-Received: by 2002:a05:6214:564b:b0:690:520d:783e with SMTP id mh11-20020a056214564b00b00690520d783emr9866888qvb.43.1709584640994; Mon, 04 Mar 2024 12:37:20 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id lq3-20020a0562145b8300b0069068161388sm2660110qvb.131.2024.03.04.12.37.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 12:37:20 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][Mantic][PATCH 1/1] pwm: Fix out-of-bounds access in of_pwm_single_xlate() Date: Mon, 4 Mar 2024 14:37:18 -0600 Message-Id: <20240304203718.25418-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304203718.25418-1-bethany.jamison@canonical.com> References: <20240304203718.25418-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Uwe Kleine-König With args->args_count == 2 args->args[2] is not defined. Actually the flags are contained in args->args[1]. Fixes: 3ab7b6ac5d82 ("pwm: Introduce single-PWM of_xlate function") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/243908750d306e018a3d4bf2eb745d53ab50f663.1704835845.git.u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König (cherry picked from commit a297d07b9a1e4fb8cda25a4a2363a507d294b7c9) CVE-2024-26599 Signed-off-by: Bethany Jamison --- drivers/pwm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c index 3dacceaef4a9b..8bd72d1148251 100644 --- a/drivers/pwm/core.c +++ b/drivers/pwm/core.c @@ -176,7 +176,7 @@ of_pwm_single_xlate(struct pwm_chip *pc, const struct of_phandle_args *args) pwm->args.period = args->args[0]; pwm->args.polarity = PWM_POLARITY_NORMAL; - if (args->args_count == 2 && args->args[2] & PWM_POLARITY_INVERTED) + if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED) pwm->args.polarity = PWM_POLARITY_INVERSED; return pwm;