[PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[Carlo Caione]

The bus matching rework made of_match_bus() return NULL for nodes
with ranges/dma-ranges but no local #address-cells. parser_init()
stored that NULL bus, and the range iterator later dereferenced it.

Reject such nodes in parser_init(), leaving an explicit empty iterator
for callers that ignore the init return. Keep the DMA limit walk guarded
by a non-empty dma-ranges property, and only clamp the limit when at
least one complete range was parsed.

Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings")
Cc: stable@vger.kernel.org
Signed-off-by: Carlo Caione <ccaione@baylibre.com>

---
Changes in v2:
- Validate na/pna/ns in parser_init() with OF_CHECK_COUNTS() /
  OF_CHECK_ADDR_COUNT()
- Link to v1: https://lore.kernel.org/r/20260706095651.48839-1-ccaione@baylibre.com
---
 drivers/of/address.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/of/address.c b/drivers/of/address.c
index cf4aab11e9b1..fd2468b89579 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -753,6 +753,7 @@ EXPORT_SYMBOL(of_property_read_reg);
 static int parser_init(struct of_pci_range_parser *parser,
 			struct device_node *node, const char *name)
 {
+	const __be32 *range;
 	int rlen;
 
 	parser->node = node;
@@ -761,12 +762,20 @@ static int parser_init(struct of_pci_range_parser *parser,
 	parser->ns = of_bus_n_size_cells(node);
 	parser->dma = !strcmp(name, "dma-ranges");
 	parser->bus = of_match_bus(node);
+	parser->range = NULL;
+	parser->end = NULL;
 
-	parser->range = of_get_property(node, name, &rlen);
-	if (parser->range == NULL)
+	range = of_get_property(node, name, &rlen);
+	if (!range)
 		return -ENOENT;
 
-	parser->end = parser->range + rlen / sizeof(__be32);
+	if (!parser->bus ||
+	    !OF_CHECK_COUNTS(parser->na, parser->ns) ||
+	    !OF_CHECK_ADDR_COUNT(parser->pna))
+		return -EINVAL;
+
+	parser->range = range;
+	parser->end = range + rlen / sizeof(__be32);
 
 	return 0;
 }
@@ -792,7 +801,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
 	int na = parser->na;
 	int ns = parser->ns;
 	int np = parser->pna + na + ns;
-	int busflag_na = parser->bus->flag_cells;
+	int busflag_na;
 
 	if (!range)
 		return NULL;
@@ -800,6 +809,8 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
 	if (!parser->range || parser->range + np > parser->end)
 		return NULL;
 
+	busflag_na = parser->bus->flag_cells;
+
 	range->flags = parser->bus->get_flags(parser->range);
 
 	range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
@@ -976,8 +987,8 @@ phys_addr_t __init of_dma_get_max_cpu_address(struct device_node *np)
 		np = of_root;
 
 	ranges = of_get_property(np, "dma-ranges", &len);
-	if (ranges && len) {
-		of_dma_range_parser_init(&parser, np);
+	if (ranges && len && !of_dma_range_parser_init(&parser, np) &&
+	    of_range_count(&parser)) {
 		for_each_of_range(&parser, &range)
 			if (range.cpu_addr + range.size > cpu_end)
 				cpu_end = range.cpu_addr + range.size - 1;
-- 
2.55.0

Re: [PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[Carlo Caione]

On Mon, Jul 6, 2026 at 1:59 PM <sashiko-bot@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Missing upper bound validation for `#size-cells` (`ns`) allows `np` to overflow to a negative value, bypassing range bounds checks and causing an infinite out-of-bounds read loop.

Since this is a pre-existing issue I'm not going to fix it in this
patch. It will be considered for a follow up but for now this is
out-of-scope.

--
Carlo Caione

Re: [PATCH v2] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

[Rob Herring]

On Mon, Jul 06, 2026 at 01:47:17PM +0200, Carlo Caione wrote:
> The bus matching rework made of_match_bus() return NULL for nodes
> with ranges/dma-ranges but no local #address-cells. parser_init()
> stored that NULL bus, and the range iterator later dereferenced it.
> 
> Reject such nodes in parser_init(), leaving an explicit empty iterator
> for callers that ignore the init return. Keep the DMA limit walk guarded
> by a non-empty dma-ranges property, and only clamp the limit when at
> least one complete range was parsed.
> 
> Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings")
> Cc: stable@vger.kernel.org
> Signed-off-by: Carlo Caione <ccaione@baylibre.com>
> 
> ---
> Changes in v2:
> - Validate na/pna/ns in parser_init() with OF_CHECK_COUNTS() /
>   OF_CHECK_ADDR_COUNT()
> - Link to v1: https://lore.kernel.org/r/20260706095651.48839-1-ccaione@baylibre.com
> ---
>  drivers/of/address.c | 23 +++++++++++++++++------
>  1 file changed, 17 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/of/address.c b/drivers/of/address.c
> index cf4aab11e9b1..fd2468b89579 100644
> --- a/drivers/of/address.c
> +++ b/drivers/of/address.c
> @@ -753,6 +753,7 @@ EXPORT_SYMBOL(of_property_read_reg);
>  static int parser_init(struct of_pci_range_parser *parser,
>  			struct device_node *node, const char *name)
>  {
> +	const __be32 *range;
>  	int rlen;
>  
>  	parser->node = node;
> @@ -761,12 +762,20 @@ static int parser_init(struct of_pci_range_parser *parser,
>  	parser->ns = of_bus_n_size_cells(node);
>  	parser->dma = !strcmp(name, "dma-ranges");
>  	parser->bus = of_match_bus(node);
> +	parser->range = NULL;
> +	parser->end = NULL;
>  
> -	parser->range = of_get_property(node, name, &rlen);
> -	if (parser->range == NULL)
> +	range = of_get_property(node, name, &rlen);
> +	if (!range)
>  		return -ENOENT;
>  
> -	parser->end = parser->range + rlen / sizeof(__be32);
> +	if (!parser->bus ||
> +	    !OF_CHECK_COUNTS(parser->na, parser->ns) ||
> +	    !OF_CHECK_ADDR_COUNT(parser->pna))
> +		return -EINVAL;
> +
> +	parser->range = range;
> +	parser->end = range + rlen / sizeof(__be32);
>  
>  	return 0;
>  }
> @@ -792,7 +801,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
>  	int na = parser->na;
>  	int ns = parser->ns;
>  	int np = parser->pna + na + ns;
> -	int busflag_na = parser->bus->flag_cells;
> +	int busflag_na;
>  
>  	if (!range)
>  		return NULL;
> @@ -800,6 +809,8 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,
>  	if (!parser->range || parser->range + np > parser->end)
>  		return NULL;
>  
> +	busflag_na = parser->bus->flag_cells;
> +
>  	range->flags = parser->bus->get_flags(parser->range);
>  
>  	range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
> @@ -976,8 +987,8 @@ phys_addr_t __init of_dma_get_max_cpu_address(struct device_node *np)
>  		np = of_root;
>  
>  	ranges = of_get_property(np, "dma-ranges", &len);
> -	if (ranges && len) {
> -		of_dma_range_parser_init(&parser, np);
> +	if (ranges && len && !of_dma_range_parser_init(&parser, np) &&
> +	    of_range_count(&parser)) {

Why do we need of_range_count() here?

>  		for_each_of_range(&parser, &range)
>  			if (range.cpu_addr + range.size > cpu_end)
>  				cpu_end = range.cpu_addr + range.size - 1;
> -- 
> 2.55.0
>