Re: [PATCH v6 1/9] block: partitions: of: Skip child nodes without reg property

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Signed integer overflow in parsing `#address-cells` and `#size-cells` leads to a massive out-of-bounds read in `of_read_number()`.
--

commit 60f98cd1d6a199dbbed8e4468a146aeef677518d
Author: Loic Poulain <loic.poulain@oss.qualcomm.com>

block: partitions: of: Skip child nodes without reg property

Child nodes of a fixed-partitions node are not necessarily partition entries.
This patch modifies validate_of_partition() to skip nodes without a reg
property, and guards add_of_partition() with a reg property check.

> diff --git a/block/partitions/of.c b/block/partitions/of.c
> index 53664ea06b654..60aa3d6906ca1 100644
> --- a/block/partitions/of.c
> +++ b/block/partitions/of.c
> @@ -15,6 +15,10 @@ static int validate_of_partition(struct device_node *np, int slot)
>  	int a_cells = of_n_addr_cells(np);
>  	int s_cells = of_n_size_cells(np);
>  
> +	/* Skip nodes without a reg property (e.g. nvmem-layout) */
> +	if (!reg)
> +		return 1;
> +
>  	/* Make sure reg len match the expected addr and size cells */
>  	if (len / sizeof(*reg) != a_cells + s_cells)
>  		return -EINVAL;

[Severity: High]
This is a pre-existing issue, but can the addition of a_cells and s_cells
overflow and bypass this length validation?

If #address-cells and #size-cells are set to values that overflow when added
as signed integers (for example, 0xffffffff and 1 via a dynamically loaded
DT overlay), and the reg property is empty, this check would evaluate to
0 != 0 and pass.

This would then pass a negative size to of_read_number() when evaluating
the offset just below this check:

block/partitions/of.c:validate_of_partition() {
	...
	/* Validate offset conversion from bytes to sectors */
	offset = of_read_number(reg, a_cells);
	...
}

include/linux/of.h:of_read_number() {
	u64 r = 0;
	while (size--)
		r = (r << 32) | be32_to_cpu(*(cell++));
	return r;
}

Since the while (size--) loop operates on signed integers without bounds
checking, a negative size wraps around, which could lead to a massive
out-of-bounds read and cause a kernel panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-block-as-nvmem-v6-0-f02513dcd46d@oss.qualcomm.com?part=1