[PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[Carlo Caione]

The bus matching rework made of_match_bus() return NULL for nodes
with ranges/dma-ranges but no local #address-cells. parser_init()
stored that NULL bus, and the range iterator later dereferenced it.

Reject such nodes in parser_init(), leaving an explicit empty iterator
for callers that ignore the init return. Keep the DMA limit walk guarded
by a non-empty dma-ranges property, and only clamp the limit when at
least one complete range was parsed.

Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings")
Cc: stable@vger.kernel.org
Signed-off-by: Carlo Caione <ccaione@baylibre.com>

---
Changes in v2:
- Validate na/pna/ns in parser_init() with OF_CHECK_COUNTS() /
  OF_CHECK_ADDR_COUNT()
- Link to v1: https://lore.kernel.org/r/20260706095651.48839-1-ccaione@baylibre.com
---
 drivers/of/address.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/of/address.c b/drivers/of/address.c
index cf4aab11e9b1..fd2468b89579 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -753,6 +753,7 @@ EXPORT_SYMBOL(of_property_read_reg);
 static int parser_init(struct of_pci_range_parser *parser,
 			struct device_node *node, const char *name)
 {
+	const __be32 *range;
 	int rlen;
 
 	parser->node = node;
@@ -761,12 +762,20 @@ static int parser_init(struct of_pci_range_parser *parser,
 	parser->ns = of_bus_n_size_cells(node);
 	parser->dma = !strcmp(name, "dma-ranges");
 	parser->bus = of_match_bus(node);
+	parser->range = NULL;
+	parser->end = NULL;
 
-	parser->range = of_get_property(node, name, &rlen);
-	if (parser->range == NULL)
+	range = of_get_property(node, name, &rlen);
+	if (!range)
 		return -ENOENT;
 
-	parser->end = parser->range + rlen / sizeof(__be32);
+	if (!parser->bus ||
+	    !OF_CHECK_COUNTS(parser->na, parser->ns) ||
+	    !OF_CHECK_ADDR_COUNT(parser->pna))
+		return -EINVAL;
+
+	parser->range = range;
+	parser->end = range + rlen / sizeof(__be32);
 
 	return 0;
 }
@@ -792,7 +801,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
 	int na = parser->na;
 	int ns = parser->ns;
 	int np = parser->pna + na + ns;
-	int busflag_na = parser->bus->flag_cells;
+	int busflag_na;
 
 	if (!range)
 		return NULL;
@@ -800,6 +809,8 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
 	if (!parser->range || parser->range + np > parser->end)
 		return NULL;
 
+	busflag_na = parser->bus->flag_cells;
+
 	range->flags = parser->bus->get_flags(parser->range);
 
 	range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
@@ -976,8 +987,8 @@ phys_addr_t __init of_dma_get_max_cpu_address(struct device_node *np)
 		np = of_root;
 
 	ranges = of_get_property(np, "dma-ranges", &len);
-	if (ranges && len) {
-		of_dma_range_parser_init(&parser, np);
+	if (ranges && len && !of_dma_range_parser_init(&parser, np) &&
+	    of_range_count(&parser)) {
 		for_each_of_range(&parser, &range)
 			if (range.cpu_addr + range.size > cpu_end)
 				cpu_end = range.cpu_addr + range.size - 1;
-- 
2.55.0

Re: [PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing upper bound validation for `#size-cells` (`ns`) allows `np` to overflow to a negative value, bypassing range bounds checks and causing an infinite out-of-bounds read loop.
--

commit 36a316bab0beafdbab73667fca4e9ad8ca56a5a3
Author: Carlo Caione <ccaione@baylibre.com>

of/address: Fix NULL bus dereference in of_pci_range_parser_one()

This commit rejects nodes with ranges/dma-ranges but no local
#address-cells in parser_init() to fix a NULL bus dereference. It also
keeps the DMA limit walk guarded by a non-empty dma-ranges property.

> diff --git a/drivers/of/address.c b/drivers/of/address.c
> index cf4aab11e9b1f..fd2468b89579f 100644
> --- a/drivers/of/address.c
> +++ b/drivers/of/address.c
> @@ -761,12 +762,20 @@ static int parser_init(struct of_pci_range_parser *parser,

[ ... ]

> -	parser->range = of_get_property(node, name, &rlen);
> -	if (parser->range == NULL)
> +	range = of_get_property(node, name, &rlen);
> +	if (!range)
>  		return -ENOENT;
>  
> -	parser->end = parser->range + rlen / sizeof(__be32);
> +	if (!parser->bus ||
> +	    !OF_CHECK_COUNTS(parser->na, parser->ns) ||

[Severity: High]
This is a pre-existing issue, but does OF_CHECK_COUNTS() need to validate an
upper bound for 'ns' (#size-cells)?

Currently, OF_CHECK_COUNTS() in drivers/of/of_private.h only validates that
'ns' is greater than 0, but unlike 'na', it does not enforce an upper limit:

#define OF_CHECK_COUNTS(na, ns) (OF_CHECK_ADDR_COUNT(na) && (ns) > 0)

If a malformed device tree provides a very large '#size-cells' value
(e.g., 0x7FFFFFFF), could this cause 'np' to overflow to a negative value in
of_pci_range_parser_one()?

drivers/of/address.c:of_pci_range_parser_one() {
    ...
    int np = parser->pna + na + ns;
    ...
    if (!parser->range || parser->range + np > parser->end)
        return NULL;
    ...
    size = of_read_number(parser->range + parser->pna + na, ns);

A negative 'np' would bypass the bounds check since subtracting from the pointer
evaluates to a smaller address. This would result in an out-of-bounds read
across memory when of_read_number() is called with the massive 'ns' value.

> +	    !OF_CHECK_ADDR_COUNT(parser->pna))
> +		return -EINVAL;
> +
> +	parser->range = range;
> +	parser->end = range + rlen / sizeof(__be32);
>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706114731.57353-1-ccaione@baylibre.com?part=1