From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <ian.campbell@citrix.com>
Subject: Re: [PATCH] xen: arm: bootfdt: Avoid reading off the
 front of *_cells array
Date: Thu, 16 Jul 2015 16:52:49 +0100
Message-ID: <1437061969.32371.235.camel@citrix.com>
References: <4EE5B48738DDED408878C97C8E050A8B1D7D1A0A@SJEXCHMB05.corp.ad.broadcom.com>
	<1437036607-1737-1-git-send-email-ian.campbell@citrix.com>
	<55A79E2E.3090201@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <55A79E2E.3090201@citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Julien Grall <julien.grall@citrix.com>
Cc: xen-devel@lists.xen.org, "Chris
	(Christopher) Brand" <chris.brand@broadcom.com>, stefano.stabellini@eu.citrix.com
List-Id: xen-devel@lists.xenproject.org

On Thu, 2015-07-16 at 14:06 +0200, Julien Grall wrote:
> Hi Ian,
> 
> On 16/07/2015 10:50, Ian Campbell wrote:
> > In device_tree_for_each_node the call to the callback was using
> > {address,size}_cells[depth - 1], which at depth 0 could read off the
> > front of the array.
> >
> > We already handled this correctly in the rest of the loop so fixup
> > this instance as well.
> >
> > Reported-by: Chris (Christopher) Brand <chris.brand@broadcom.com>
> > Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> > Cc: Chris (Christopher) Brand <chris.brand@broadcom.com>
> 
> Good catch! Do you plan to backport to Xen 4.5 and apply to Xen 4.6?
> 
> Reviewed-by: Julien Grall <julien.grall@citrix.com>

Applied and queue for backport, thanks.