Kory Maincent 5099807f33 net: pse-pd: fix out-of-bounds bitmap access in pse_isr() on 32-bit ... In pse_isr(), notifs_mask was declared as a single unsigned long on the stack (32 bits on 32-bit architectures). For PSE controllers with more than 32 ports, this causes two problems: - map_event callbacks could wrote bit positions >= 32 via *notifs_mask |= BIT(i), which is undefined behaviour on a 32-bit unsigned long and corrupts adjacent stack memory. - for_each_set_bit(i, &notifs_mask, pcdev->nr_lines) treats &notifs_mask as a multi-word bitmap and reads beyond the single unsigned long when nr_lines > BITS_PER_LONG. Fix this by moving notifs_mask out of the stack and into struct pse_irq as a dynamically allocated bitmap. It is sized with BITS_TO_LONGS(pcdev->nr_lines) words in devm_pse_irq_helper(), so it is always wide enough regardless of the host word size. [Jakub]: No upstream driver currently supports >=32 ports. Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260415130300.806152-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-04-16 19:25:32 -07:00
..
Kconfig	net: pse-pd: Add Si3474 PSE controller driver	2025-08-28 14:41:59 +02:00
Makefile	net: pse-pd: Add Si3474 PSE controller driver	2025-08-28 14:41:59 +02:00
pd692x0.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
pse_core.c	net: pse-pd: fix out-of-bounds bitmap access in pse_isr() on 32-bit	2026-04-16 19:25:32 -07:00
pse_regulator.c	net: pse-pd: Remove is_enabled callback from drivers	2025-01-14 13:56:32 +01:00
si3474.c	net: pse-pd: Add Si3474 PSE controller driver	2025-08-28 14:41:59 +02:00
tps23881.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00