releases/6.6.26/regmap-maple-fix-cache-corruption-in-regcache_maple_.patch

   1 From 36a80e0fd2a330ce0cb25f16c52156087805b22f Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Wed, 27 Mar 2024 11:44:06 +0000
   4 Subject: regmap: maple: Fix cache corruption in regcache_maple_drop()
   5
   6 From: Richard Fitzgerald <rf@opensource.cirrus.com>
   7
   8 [ Upstream commit 00bb549d7d63a21532e76e4a334d7807a54d9f31 ]
   9
  10 When keeping the upper end of a cache block entry, the entry[] array
  11 must be indexed by the offset from the base register of the block,
  12 i.e. max - mas.index.
  13
  14 The code was indexing entry[] by only the register address, leading
  15 to an out-of-bounds access that copied some part of the kernel
  16 memory over the cache contents.
  17
  18 This bug was not detected by the regmap KUnit test because it only
  19 tests with a block of registers starting at 0, so mas.index == 0.
  20
  21 Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
  22 Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache")
  23 Link: https://msgid.link/r/20240327114406.976986-1-rf@opensource.cirrus.com
  24 Signed-off-by: Mark Brown <broonie@kernel.org>
  25 Signed-off-by: Sasha Levin <sashal@kernel.org>
  26 ---
  27  drivers/base/regmap/regcache-maple.c | 2 +-
  28  1 file changed, 1 insertion(+), 1 deletion(-)
  29
  30 diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
  31 index 41edd6a430eb4..c1776127a5724 100644
  32 --- a/drivers/base/regmap/regcache-maple.c
  33 +++ b/drivers/base/regmap/regcache-maple.c
  34 @@ -145,7 +145,7 @@ static int regcache_maple_drop(struct regmap *map, unsigned int min,
  35                         upper_index = max + 1;
  36                         upper_last = mas.last;
  37
  38 -                       upper = kmemdup(&entry[max + 1],
  39 +                       upper = kmemdup(&entry[max - mas.index + 1],
  40                                         ((mas.last - max) *
  41                                          sizeof(unsigned long)),
  42                                         map->alloc_flags);
  43 --
  44 2.43.0
  45