github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Devicetree fixes for v7.2, part 1:

Browse Source 
- Fix NULL bus dereference in of_pci_range_parser_one()
 
 - Prevent OOB access when too many dynamic reserved memory regions are
   defined
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmptCRcACgkQ+vtdtY28
 YcN4oQ/9GJYlymn6frwBmPiG7iVK8OQgvFClUn61/nTuyvaOv5mXDQzbRsP1TqMG
 xn+XqAww6XCT4k08bxVe1nORJAIkittVjXLcWLU4EnO7+rHFZnXpEeijWDqMuYT8
 rbEArsFyC1u4Uk+TXMwd0lqTZNogrJWR1hXd+T4Kecv+ORVbBeKMdWPZkMdK/KTP
 h88iio1V489hdufVMLjcORoySh23i1qJ1qBgjHZIS0lpdBbg2JiXfLvUJHCWHRiU
 W2Ucrpz/Wq//86pBie+TWn0IisYOvTB8g/ZLnrG33iN7+HaQMxlP+Cs90V6T9cGi
 DQ64LPfvRQrr0KlZ1TxoEy9N2N3SQXJ3l/Hq+nK08B6xlHl+d67cSRzxra/6qs3Z
 7scbD5K+K6A9MnSlLn4+wxOyocF/rMHBu+RUUdiO/PqHoFe0TpMR3GHpRysGcebG
 OPNbZ1dP8TGaG38wOKj+ZJldoNABO0Sox0/OMv1WNHFbbhoyoDDlajDxJua3lO3U
 X4NN/C0bS5EiGSqSZ5SpiAF85Qj13s0RPBB223bEG7PxBA7kfk0UnU/OQwkJLb2y
 8GIuG4qWeCXQhcWqxBf++DhmS61LzY3D49qHD4c6oD7ji/3ZGeWR9yyI3o/PQcG+
 Gvj4CrQTCicLYgiJxL4VvKuXhXy6JhuJQi/kddO6GfwEyC5IWek=
 =9x2Y
 -----END PGP SIGNATURE-----

Merge tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree fixes from Rob Herring:

 - Fix NULL bus dereference in of_pci_range_parser_one()

 - Prevent out-of-bounds access when too many dynamic reserved memory
   regions are defined

* tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  of/address: Fix NULL bus dereference in of_pci_range_parser_one()
  of: reserved_mem: prevent OOB when too many dynamic regions are defined
This commit is contained in:
Linus Torvalds 2026-07-31 14:03:19 -07:00
commit a2cf4ef331
2 changed files with 27 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/of/address.c
View File

@ -753,6 +753,7 @@ EXPORT_SYMBOL(of_property_read_reg);
static int parser_init(struct of_pci_range_parser *parser,
struct device_node *node, const char *name)
{
const __be32 *range;
int rlen;
parser->node = node;
@ -761,12 +762,20 @@ static int parser_init(struct of_pci_range_parser *parser,
parser->ns = of_bus_n_size_cells(node);
parser->dma = !strcmp(name, "dma-ranges");
parser->bus = of_match_bus(node);
parser->range = NULL;
parser->end = NULL;
parser->range = of_get_property(node, name, &rlen);
if (parser->range == NULL)
range = of_get_property(node, name, &rlen);
if (!range)
return -ENOENT;
parser->end = parser->range + rlen / sizeof(__be32);
if (!parser->bus ||
!OF_CHECK_COUNTS(parser->na, parser->ns) ||
!OF_CHECK_ADDR_COUNT(parser->pna))
return -EINVAL;
parser->range = range;
parser->end = range + rlen / sizeof(__be32);
return 0;
}
@ -792,7 +801,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
int na = parser->na;
int ns = parser->ns;
int np = parser->pna + na + ns;
int busflag_na = parser->bus->flag_cells;
int busflag_na;
if (!range)
return NULL;
@ -800,6 +809,8 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
if (!parser->range || parser->range + np > parser->end)
return NULL;
busflag_na = parser->bus->flag_cells;
range->flags = parser->bus->get_flags(parser->range);
range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
@ -976,8 +987,7 @@ phys_addr_t __init of_dma_get_max_cpu_address(struct device_node *np)
np = of_root;
ranges = of_get_property(np, "dma-ranges", &len);
if (ranges && len) {
of_dma_range_parser_init(&parser, np);
if (ranges && len && !of_dma_range_parser_init(&parser, np)) {
for_each_of_range(&parser, &range)
if (range.cpu_addr + range.size > cpu_end)
cpu_end = range.cpu_addr + range.size - 1;

14
drivers/of/of_reserved_mem.c
View File

@ -359,6 +359,7 @@ int __init fdt_scan_reserved_mem(void)
err = __reserved_mem_reserve_reg(child, uname);
if (!err)
count++;
/*
* Save the nodes for the dynamically-placed regions
* into an array which will be used for allocation right
@ -366,10 +367,17 @@ int __init fdt_scan_reserved_mem(void)
* or marked as no-map. This is done to avoid dynamically
* allocating from one of the statically-placed regions.
*/
if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) {
dynamic_nodes[dynamic_nodes_cnt] = child;
dynamic_nodes_cnt++;
if (err != -ENOENT || !of_get_flat_dt_prop(child, "size", NULL))
continue;
if (dynamic_nodes_cnt == MAX_RESERVED_REGIONS) {
pr_err("too many defined dynamic regions, skip '%s'\n",
uname);
continue;
}
dynamic_nodes[dynamic_nodes_cnt] = child;
dynamic_nodes_cnt++;
}
for (int i = 0; i < dynamic_nodes_cnt; i++) {
const char *uname;