From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 65C17C43458 for ; Tue, 7 Jul 2026 16:08:45 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.1356403.1611035 (Exim 4.92) (envelope-from ) id 1wh8LM-0001nZ-09; Tue, 07 Jul 2026 16:08:20 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356403.1611035; Tue, 07 Jul 2026 16:08:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8LL-0001nS-S9; Tue, 07 Jul 2026 16:08:19 +0000 Received: by outflank-mailman (input) for mailman id 1356403; Tue, 07 Jul 2026 16:08:18 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) id 1wh8LJ-0001nJ-Sk for xen-devel@lists.xenproject.org; Tue, 07 Jul 2026 16:08:18 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wh8LJ-00EcjV-66 for xen-devel@lists.xenproject.org; Tue, 07 Jul 2026 18:08:17 +0200 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a4d2455-5cb7-0a2a0a5109dd-0a2a450bbc16-38 for ; Tue, 07 Jul 2026 18:08:17 +0200 Received: from [209.85.208.176] (helo=mail-lj1-f176.google.com) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a4d2470-ac48-0a2a450b0019-d155d0b0b089-3 for ; Tue, 07 Jul 2026 18:08:17 +0200 Received: by mail-lj1-f176.google.com with SMTP id 38308e7fff4ca-39b237fb695so39194001fa.2 for ; Tue, 07 Jul 2026 09:08:17 -0700 (PDT) Received: from [192.168.1.6] (user-109-243-144-234.play-internet.pl. [109.243.144.234]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-39c623cfc44sm6565081fa.14.2026.07.07.09.08.15 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 07 Jul 2026 09:08:15 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=gmail.com header.i="@gmail.com" header.h="Content-Transfer-Encoding:Content-Type:In-Reply-To:From:Content-Language:References:Cc:To:Subject:User-Agent:MIME-Version:Date:Message-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783440496; x=1784045296; darn=lists.xenproject.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=WWxMpHg7lAWkCq6epiSXOIyG9B64F/IjH7XWnjuduO4=; b=qRfPinQKxaLqqO6krowpx5rYAolyw+SVwpoZ3tyesz/XUKCItIL35KXC9ZQNcad9/R UN84ybvv/wRhZ3ydvN5R6NuLy5MUgS8/qLo6aF8yMUuHgXlN6t+21QFry4XiF8s3cFzh d/iV0lyF5jk3LsVLzgGGqJyidMqPrwJwJy4yLmX1FrY+9AbmeSovJfJAaBzXqYtw1q8Y QWU/0Ko0KEqIlaU/oRGYjWJhiAtYxr01WxRjVusQEav7sBjbrTUExFcuA09xAI2mWNWm ZnENGXBv40XgLYAfmkiindbKwSqrcMMkidd5pZAdanwhe0QqyxkTvOnMhDC7YrLvKcd+ 1mBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783440496; x=1784045296; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WWxMpHg7lAWkCq6epiSXOIyG9B64F/IjH7XWnjuduO4=; b=BcsqdJc3snA3kW2VN1Yv1DWxJoFZVambdJjq8FRbLV8Oddg9eVhkFVz++7M3bEIEww Rhugsd/ge2uSfiSaNCXRFcwSD4g97Pi+unpmTT1SC2S8k9/9Ga9MixtZeM/a0gfvMcBg oceVM8EeP3ypi7b+gOmDfprEIJ2y72n+ytFTq9DvdAMgARlS+eWBwPnB3Ra7KDESc9CZ QW3/WfDNomkHaq3LLVi/1YAWB9Ug4XIOO5SvD+xOQgLD4EQJci/dNcLBkHaz6NN3B8Kd NshCJcCsyZAFW+pqJN+SDBEEaBLSZRlTEy5eg2on4lxzPSlsJ3y9Vzqw3ChNXK0J5pe8 SVTw== X-Forwarded-Encrypted: i=1; AHgh+RqHauLdDuktm1pPXyzw/+JKz7VkwIamB42M0cjYY9RXYBnx4OhR5uuwD/qN+78HgYTy+z1lsT4jzwk=@lists.xenproject.org X-Gm-Message-State: AOJu0YwTpETPHhwYGMkyF74T3eSxR/v4fPl3g5kYhr23LqgsfplpdU2E ExXXRN3el0ZQ/sMiWJMCA/NQiL1/nTGneoL6ewYb7yJrpgE8rxIflxC+ X-Gm-Gg: AfdE7clziYpVeXNCR1svkQbunj44SKYAYr0npttPd/RHC1X99EC6uCc2r8o1psi3aH0 b3K/Kjzs4u0tqeCMKnal42vQgcOaZQQA380S/SM8UL4V/ALlgQi0SCJ6Sm9JFU2o7olRlwDGoXi e2hkXoReckZyEe9ei/13NdYYrAybY/huhN3+zOTnZJQ3r1zTx47oZ1UAtq60CxfVvjG6YIcGIH2 XP+9J8n/2nLWzclAQSDoWaR+yhmf/7EBL3lLQ5/MB4st3TH46eaxLI32UUV8Hy42765XMN8o1i6 nu5Y7rd047Aonhz4/BFUXy3KH4NTvsGJ4Zzr3+li4c6ANVLTtyx1LvnzYLiavWeKiXpzq4uIuo1 J8kFoPf4qZ+JqctUECQh8GiI9phvsBj9ScsuEQr4fKvfzwXKOVXx7hbUbprT4g7H2jxnPoNCFYG 6Ika3siePKHq1Ep15g5hJOVD5/Rutaozi05mLa/nCZV/KDSeGiAJrrhxfgTbPzIRn2zKM= X-Received: by 2002:a05:651c:2206:b0:39b:1f5:e041 with SMTP id 38308e7fff4ca-39c6006d7dfmr13205781fa.37.1783440496054; Tue, 07 Jul 2026 09:08:16 -0700 (PDT) Message-ID: Date: Tue, 7 Jul 2026 18:08:14 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH for-4.22] dom0less: Prevent division by zero in handle_passthrough_prop() To: Dmytro Prokopchuk1 , "xen-devel@lists.xenproject.org" Cc: Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel References: Content-Language: en-US From: Oleksii Kurochko In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-purgate-ID: tlsNG-42698a/1783440497-A5B20220-024207E6/10/73395122804 X-purgate-type: spam X-purgate-size: 2148 On 7/7/26 5:16 PM, Dmytro Prokopchuk1 wrote: > A malformed provided partial DTB specifying both '#address-cells = <0>' > and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to > evaluate to 0. This sum is subsequently used as a divisor when calculating > the number of regions in the 'xen,reg' property: > > len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * > sizeof(uint32_t)); > > This leads to a division by zero exception in the Xen hypervisor during > boot, causing a hypervisor panic/crash. > > Fix this by validating that '(address_cells * 2 + size_cells)' is greater > than zero before performing the division. If it is zero, log an error > message and return -EINVAL. > Fix tag is missed. > Signed-off-by: Dmytro Prokopchuk > --- > xen/common/device-tree/dom0less-build.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c > index eacfd93087..6796851844 100644 > --- a/xen/common/device-tree/dom0less-build.c > +++ b/xen/common/device-tree/dom0less-build.c > @@ -154,6 +154,13 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, > > /* xen,reg specifies where to map the MMIO region */ > cell = (const __be32 *)xen_reg->data; > + > + if ( (address_cells * 2 + size_cells) == 0 ) Considering that this calculation happens second time here ... > + { > + printk(XENLOG_ERR "Invalid address/size cells combination (both 0)\n"); > + return -EINVAL; > + } > + > len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * > sizeof(uint32_t)); ... I think it would be nice to calculate that once. Generally I am okay to not declare local separate variable for these calculations. With adding Fix tag: Reviewed-by: Oleksii Kurochko Release-Acked-by: Oleksii Kurochko Thanks. ~ Oleksii