iommu/mediatek-v1: add missing larb count sanity check

Add the missing larb count sanity check to avoid writing beyond a fixed
sized array in case of a malformed devicetree.

Acked-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Yong Wu <yong.wu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>

diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 86686455e911b6062299fe47f1a528a91ff99775..c8d8eff5373d303861a1ebfaf63c1e89c4fa8d2f 100644 (file)
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -646,6 +646,9 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
        if (larb_nr < 0)
                return larb_nr;
 
+       if (larb_nr > MTK_LARB_NR_MAX)
+               return -EINVAL;
+
        for (i = 0; i < larb_nr; i++) {
                struct device_node *larbnode;
                struct platform_device *plarbdev;