linux-kernel - Re: [PATCH 1/8] of/irq: Fix wrong value of variable @len in of_irq_parse_imap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241209205613.GB938291-robh@kernel.org>
Date: Mon, 9 Dec 2024 14:56:13 -0600
From: Rob Herring <robh@...nel.org>
To: Zijun Hu <zijun_hu@...oud.com>
Cc: Saravana Kannan <saravanak@...gle.com>,
	Lorenzo Pieralisi <lpieralisi@...nel.org>,
	Bjorn Helgaas <bhelgaas@...gle.com>, Marc Zyngier <maz@...nel.org>,
	Stefan Wiehler <stefan.wiehler@...ia.com>,
	Grant Likely <grant.likely@...aro.org>,
	Tony Lindgren <tony@...mide.com>, Kumar Gala <galak@...eaurora.org>,
	Thierry Reding <thierry.reding@...il.com>,
	Julia Lawall <Julia.Lawall@...6.fr>,
	Jamie Iles <jamie@...ieiles.com>,
	Grant Likely <grant.likely@...retlab.ca>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
	Rob Herring <rob.herring@...xeda.com>,
	Zijun Hu <quic_zijuhu@...cinc.com>, stable@...r.kernel.org
Subject: Re: [PATCH 1/8] of/irq: Fix wrong value of variable @len in
 of_irq_parse_imap_parent()

On Mon, Dec 09, 2024 at 09:24:59PM +0800, Zijun Hu wrote:
> From: Zijun Hu <quic_zijuhu@...cinc.com>
> 
> Fix wrong @len value by 'len--' after 'imap++'
> in of_irq_parse_imap_parent().
> 
> Fixes: 935df1bd40d4 ("of/irq: Factor out parsing of interrupt-map parent phandle+args from of_irq_parse_raw()")
> Cc: stable@...r.kernel.org
> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
> ---
>  drivers/of/irq.c | 1 +
>  1 file changed, 1 insertion(+)

Applied, but rewrote the commit message:

of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()

On a malformed interrupt-map property which is shorter than expected by 
1 cell, we may read bogus data past the end of the property instead of
returning an error in of_irq_parse_imap_parent().

Decrement the remaining length when skipping over the interrupt parent  
phandle cell.