linux-kernel - Re: [PATCH v2] mailbox: Prevent out-of-bounds access in of_mbox_index

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABb+yY24nzXw_9+CAtsvV2L_+=8206u+RYCyqPSmad9fO7gGEg@mail.gmail.com>
Date: Thu, 18 Sep 2025 18:26:06 -0500
From: Jassi Brar <jassisinghbrar@...il.com>
To: Joonwon Kang <joonwonkang@...gle.com>
Cc: peng.fan@....nxp.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()

On Thu, Sep 18, 2025 at 7:55 AM Joonwon Kang <joonwonkang@...gle.com> wrote:
>
> Although it is guided that `#mbox-cells` must be at least 1, there are
> many instances of `#mbox-cells = <0>;` in the device tree. If that is
> the case and the corresponding mailbox controller does not provide
> `of_xlate` function pointer, `of_mbox_index_xlate()` will be used by
> default and out-of-bounds accesses could occur due to lack of bounds
> check in that function.
>
OK, so we want of_mbox_index_xlate() to refuse if the channel's index
is not available, which
will be the case when #mbox-cells=<0> in dt and sp->args_count=0 here.
Fair enough.

I think the following details are unnecessary, maybe drop it.

Thanks