From mboxrd@z Thu Jan  1 00:00:00 1970
From: Julien Grall <julien.grall@citrix.com>
Subject: Re: [PATCH] xen: arm: bootfdt: Avoid reading off the
 front of *_cells array
Date: Thu, 16 Jul 2015 14:06:06 +0200
Message-ID: <55A79E2E.3090201@citrix.com>
References: <4EE5B48738DDED408878C97C8E050A8B1D7D1A0A@SJEXCHMB05.corp.ad.broadcom.com>
	<1437036607-1737-1-git-send-email-ian.campbell@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1437036607-1737-1-git-send-email-ian.campbell@citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Ian Campbell <ian.campbell@citrix.com>, stefano.stabellini@eu.citrix.com, xen-devel@lists.xen.org
Cc: "Chris (Christopher) Brand" <chris.brand@broadcom.com>
List-Id: xen-devel@lists.xenproject.org

Hi Ian,

On 16/07/2015 10:50, Ian Campbell wrote:
> In device_tree_for_each_node the call to the callback was using
> {address,size}_cells[depth - 1], which at depth 0 could read off the
> front of the array.
>
> We already handled this correctly in the rest of the loop so fixup
> this instance as well.
>
> Reported-by: Chris (Christopher) Brand <chris.brand@broadcom.com>
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> Cc: Chris (Christopher) Brand <chris.brand@broadcom.com>

Good catch! Do you plan to backport to Xen 4.5 and apply to Xen 4.6?

Reviewed-by: Julien Grall <julien.grall@citrix.com>

Regards,

-- 
Julien Grall