From patchwork Mon Oct 31 03:41:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Samuel Holland X-Patchwork-Id: 1697000 X-Patchwork-Delegate: sjg@chromium.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=sholland.org header.i=@sholland.org header.a=rsa-sha256 header.s=fm1 header.b=bsZ/XUVg; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=SQgTs2oP; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4N0zTx3Qxrz23lV for ; Mon, 31 Oct 2022 14:41:41 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 57AF08555E; Mon, 31 Oct 2022 04:41:38 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=sholland.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=sholland.org header.i=@sholland.org header.b="bsZ/XUVg"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.b="SQgTs2oP"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 9CFA08555B; Mon, 31 Oct 2022 04:41:36 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 358728555E for ; Mon, 31 Oct 2022 04:41:33 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=sholland.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=samuel@sholland.org Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id B4C315C0083; Sun, 30 Oct 2022 23:41:31 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute2.internal (MEProxy); Sun, 30 Oct 2022 23:41:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sholland.org; h= cc:cc:content-transfer-encoding:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:sender:subject:subject:to:to; s=fm1; t=1667187691; x=1667274091; bh=tofxpx5AYuJ3Kd25mPZYJhK4I wO6tJIZMu5L6ijkJ5s=; b=bsZ/XUVgMiOsf5sJB/2u7hHHAedpGOdGlgd6cZo0t b67O1V1V0snyaDeDM8dHd6HvyUXRUuvDD01523NHzJ4XSJwYY0NR0b6zk/xqu6PP yhqY5XgIjlPekmOpsJuoSgiGA6kxwxmmtPTnFOxAKR7j5VyUdPCXvJZZ+vcLrXrs IEgg9NdSa3aK/Ss63npkz4bZnpFEmGSqE3wUBGhRdaddQ3PLnFEBh7xH0+1z+rlz jH4BEhMKj1aO5CuRmjLr2rikgZyJuD886dFSR58cZ3KkbqqGAzrFSRIWXEzZK7VM 2/vdwtikyuP4mgWkZ0ydQF2NyVsLjggNUjn5obiVXgwbQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding:date:date :feedback-id:feedback-id:from:from:in-reply-to:message-id :mime-version:reply-to:sender:subject:subject:to:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1667187691; x=1667274091; bh=tofxpx5AYuJ3Kd25mPZYJhK4IwO6tJIZMu5 L6ijkJ5s=; b=SQgTs2oPvUlPGa4J67IHspMcn42CT41lFtFl6oJfGGI3tuYW/Xo furTYSwYuQSBpBRJoyhaRDStIhuYN8w506PY5xZfhwA6mF5nibSW4xURoDEr14tz EdKaRl2+m7KuES1u33G0KY70pw6EZPeBZTP9Lc8Vg4JfvJvpBk4g5Zo64sFHvf5K TUFKgNXTofzahN5j0t1XielDBazEwTOi6jZYbwGnhx0Nyu0qvdmdHkGTUTfF50Jz tPd0AKIC5tV15Nk+qJ1Enn0YE5ONSviqx7dqVAeg7sjZ+QhlU+s0MPFyHrQq7gLM KE7bmm/MjkzMnPI61M/wE+G4dLlgjmD9mRA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvgedruddugdeitdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefhvfevufffkffoggfgsedtkeertdertddtnecuhfhrohhmpefurghmuhgvlhcu jfholhhlrghnugcuoehsrghmuhgvlhesshhhohhllhgrnhgurdhorhhgqeenucggtffrrg htthgvrhhnpeekveelhfejueelleetvdejvdeffeetgeelheeujeffhefgffefkeehhffh keekgeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hsrghmuhgvlhesshhhohhllhgrnhgurdhorhhg X-ME-Proxy: Feedback-ID: i0ad843c9:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 30 Oct 2022 23:41:21 -0400 (EDT) From: Samuel Holland To: Simon Glass Cc: Samuel Holland , Jagan Teki , Mugunthan V N , u-boot@lists.denx.de Subject: [PATCH] fdt: Fix bounds check in devfdt_get_addr_index Date: Sun, 30 Oct 2022 22:41:19 -0500 Message-Id: <20221031034120.26159-1-samuel@sholland.org> X-Mailer: git-send-email 2.37.3 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean reg must contain enough cells for the entire next address/size pair after skipping `index` pairs. The previous code allows an out-of-bounds read when na + ns > 1. Fixes: 69b41388ba45 ("dm: core: Add a new api to get indexed device address") Signed-off-by: Samuel Holland Reviewed-by: Simon Glass --- drivers/core/fdtaddr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/core/fdtaddr.c b/drivers/core/fdtaddr.c index 91bcd1a2c2..50ea05263e 100644 --- a/drivers/core/fdtaddr.c +++ b/drivers/core/fdtaddr.c @@ -43,7 +43,7 @@ fdt_addr_t devfdt_get_addr_index(const struct udevice *dev, int index) } reg = fdt_getprop(gd->fdt_blob, offset, "reg", &len); - if (!reg || (len <= (index * sizeof(fdt32_t) * (na + ns)))) { + if (!reg || (len < ((index + 1) * sizeof(fdt32_t) * (na + ns)))) { debug("Req index out of range\n"); return FDT_ADDR_T_NONE; }