linux-kernel - [PATCH v2] of: fix iteration bug over CPU reg properties

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1381843853-13871-1-git-send-email-grant.likely@linaro.org>
Date:	Tue, 15 Oct 2013 14:30:53 +0100
From:	Grant Likely <grant.likely@...aro.org>
To:	linux-kernel@...r.kernel.org, devicetree@...r.kernel.org
Cc:	Grant Likely <grant.likely@...aro.org>,
	Rob Herring <rob.herring@...xeda.com>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>
Subject: [PATCH v2] of: fix iteration bug over CPU reg properties

The size of each hwid in a cpu nodes 'reg' property is defined by the
parents #address-cells property in the normal way. The cpu parsing code
has a bug where it will overrun the end of the property if
address-cells is greater than one. This commit fixes the problem by
adjusting the array size by the number of address cells. It also makes
sure address-cells isn't zero for that would cause an infinite loop.

v2: bail if #address-cells is zero instead of forcing to
    OF_ROOT_NODE_ADDR_CELLS_DEFAULT. Forcing it will cause the reg
    property to be parsed incorrectly.
Signed-off-by: Grant Likely <grant.likely@...aro.org>
Cc: Rob Herring <rob.herring@...xeda.com>
Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
---
 drivers/of/base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 15c4b59..a96f850 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -272,9 +272,9 @@ static bool __of_find_n_match_cpu_property(struct device_node *cpun,
 
 	ac = of_n_addr_cells(cpun);
 	cell = of_get_property(cpun, prop_name, &prop_len);
-	if (!cell)
+	if (!cell || !ac)
 		return false;
-	prop_len /= sizeof(*cell);
+	prop_len /= sizeof(*cell) * ac;
 	for (tid = 0; tid < prop_len; tid++) {
 		hwid = of_read_number(cell, ac);
 		if (arch_match_cpu_phys_id(cpu, hwid)) {
-- 
1.8.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/