linux-kernel - Re: [PATCH 4/8] of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241209211916.GD938291-robh@kernel.org>
Date: Mon, 9 Dec 2024 15:19:16 -0600
From: Rob Herring <robh@...nel.org>
To: Zijun Hu <zijun_hu@...oud.com>
Cc: Saravana Kannan <saravanak@...gle.com>,
	Lorenzo Pieralisi <lpieralisi@...nel.org>,
	Bjorn Helgaas <bhelgaas@...gle.com>, Marc Zyngier <maz@...nel.org>,
	Stefan Wiehler <stefan.wiehler@...ia.com>,
	Grant Likely <grant.likely@...aro.org>,
	Tony Lindgren <tony@...mide.com>, Kumar Gala <galak@...eaurora.org>,
	Thierry Reding <thierry.reding@...il.com>,
	Julia Lawall <Julia.Lawall@...6.fr>,
	Jamie Iles <jamie@...ieiles.com>,
	Grant Likely <grant.likely@...retlab.ca>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
	Rob Herring <rob.herring@...xeda.com>,
	Zijun Hu <quic_zijuhu@...cinc.com>, stable@...r.kernel.org
Subject: Re: [PATCH 4/8] of/irq: Fix using uninitialized variable @addr_len
 in API of_irq_parse_one()

On Mon, Dec 09, 2024 at 09:25:02PM +0800, Zijun Hu wrote:
> From: Zijun Hu <quic_zijuhu@...cinc.com>
> 
> of_irq_parse_one() may use uninitialized variable @addr_len as shown below:
> 
> // @addr_len is uninitialized
> int addr_len;
> 
> // This operation does not touch @addr_len if it fails.
> addr = of_get_property(device, "reg", &addr_len);
> 
> // Use uninitialized @addr_len if the operation fails.
> if (addr_len > sizeof(addr_buf))
> 	addr_len = sizeof(addr_buf);
> 
> // Check the operation result here.
> if (addr)
> 	memcpy(addr_buf, addr, addr_len);
> 
> Fix by initializing @addr_len before the operation.
> 
> Fixes: b739dffa5d57 ("of/irq: Prevent device address out-of-bounds read in interrupt map walk")
> Cc: stable@...r.kernel.org
> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
> ---
>  drivers/of/irq.c | 1 +
>  1 file changed, 1 insertion(+)

Applied, thanks.

Rob