irqchip/stm32-exti: Prevent illegal read due to unbounded DT value

The value hwirq is received from DT. If it exceeds the maximum
valid value it causes the code to address unexisting irq chips
reading outside the array boundary.

Check the value of hwirq before using it.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20220606162757.415354-4-antonio.borneo@foss.st.com

diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 1145f064faa84542f30ee713a23a84fbbafd01f7..e2722e499ae55d07e2441de419e3d912e44077d8 100644 (file)
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -713,6 +713,9 @@ static int stm32_exti_h_domain_alloc(struct irq_domain *dm,
        int bank;
 
        hwirq = fwspec->param[0];
+       if (hwirq >= host_data->drv_data->bank_nr * IRQS_PER_BANK)
+               return -EINVAL;
+
        bank  = hwirq / IRQS_PER_BANK;
        chip_data = &host_data->chips_data[bank];