Re: [PATCH v2 2/4] misc: fastrpc: handle multi-cell reg in context bank probe

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] misc: fastrpc: out-of-bounds read due to index underflow bypassing bounds check
--

commit a9dd81ce5afe0b6b73eb7394627f61e8448d9435
Author: Vinayak Katoch <vinayak.katoch@oss.qualcomm.com>

misc: fastrpc: handle multi-cell reg in context bank probe

Platforms that use #address-cells = <2> on the fastrpc node encode the
context bank number in cell[1] of the reg property rather than cell[0].
Reading cell[0] on such platforms yields 0 for every context bank,
causing all sessions to share SID 0 and corrupting IOVA address
construction.

> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index b29c1fd00de28..5c7bb56cf46d0 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -2348,7 +2348,8 @@ static int fastrpc_cb_init(struct platform_device *pdev)
>  	if (!cctx)
>  		return -EINVAL;
>  
> -	if (of_property_read_u32(dev->of_node, "reg", &sid))
> +	if (of_property_read_u32_index(dev->of_node, "reg",
> +				       of_n_addr_cells(dev->of_node) - 1, &sid))

[Severity: High]
Can this code underflow the index if a malformed device tree explicitly sets
#address-cells = <0> on the parent node?

If of_n_addr_cells() evaluates to 0, the unchecked subtraction introduces an
underflow. Because the index argument to of_property_read_u32_index() is a
u32, this implicitly casts -1 to 0xFFFFFFFF.

This propagates down to bypass bounds checking in the property reader:

drivers/of/property.c:of_property_read_u32_index() {
    ...
	const u32 *val = of_find_property_value_of_size(np, propname,
					((index + 1) * sizeof(*out_value)),
					0,
					NULL);
    ...
}

The index + 1 expression wraps to 0 here, reducing the min size to 0 and
defeating the internal length check inside of_find_property_value_of_size().

This subsequently triggers an out-of-bounds read when extracting the value:

drivers/of/property.c:of_property_read_u32_index() {
    ...
	*out_value = be32_to_cpup(((__be32 *)val) + index);
    ...
}

This pointer arithmetic adds 0xFFFFFFFF to the base property address, resulting
in an immediate out-of-bounds memory dereference traversing approximately 17 GB
past the base pointer.

>  		dev_info(dev, "FastRPC Session ID not specified in DT\n");
>  
>  	spin_lock_irqsave(&cctx->lock, flags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007-extended-mapping-v2-0-5dca3aa2c2d3@oss.qualcomm.com?part=2