CVE-2022-49551

BUG: KASAN: global-out-of-bounds in isp1760register+0x180/0x70c Read of size 20 at addr f1db2e64 by task swapper/0/1 (...) isp1760register from isp1760platprobe+0x1d8/0x220 (...)

This happens because the loop reading the regmap fields for the different ISP1760 variants look like this:

for (i = 0; i < HCFIELDMAX; i++) { ... }

Meaning it expects the arrays to be at least HCFIELDMAX - 1 long.

However the arrays isp1760hcregfields[], isp1763hcregfields[], isp1763hcvolatileranges[] and isp1763dcvolatileranges[] are dynamically sized during compilation.

Fix this by putting an empty assignment to the [HCFIELDMAX] and [DCFIELDMAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HCFIELDMAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on.

References

Affected packages

Debian:12 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.18.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name: linux
Purl: pkg:deb/debian/linux?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.18.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}