From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Grall Subject: [PATCH V1 11/29] xen/dts: Check "reg" property length in process_multiboot_node Date: Wed, 28 Aug 2013 15:47:25 +0100 Message-ID: <1377701263-3319-12-git-send-email-julien.grall@linaro.org> References: <1377701263-3319-1-git-send-email-julien.grall@linaro.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1377701263-3319-1-git-send-email-julien.grall@linaro.org> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: patches@linaro.org, Julien Grall , ian.campbell@citrix.com, andre.przywara@linaro.org, stefano.stabellini@eu.citrix.com List-Id: xen-devel@lists.xenproject.org When the device tree compiler (dtc) can't find right #address-cells and #size-cells, it will assume the encoding is 1 for each. As multiboot node are inside the /chosen, dtc will asume the previous values if the both property are not correct set. During boot, Xen will browse the fdt and store the nearest #address-cells and #size-cells value. If the size of "reg" is smaller, Xen can retrieve wrong range. Signed-off-by: Julien Grall --- xen/common/device_tree.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/xen/common/device_tree.c b/xen/common/device_tree.c index 9568250..7295f34 100644 --- a/xen/common/device_tree.c +++ b/xen/common/device_tree.c @@ -467,10 +467,14 @@ static void __init process_multiboot_node(const void *fdt, int node, mod = &early_info.modules.module[nr]; - prop = fdt_get_property(fdt, node, "reg", NULL); + prop = fdt_get_property(fdt, node, "reg", &len); if ( !prop ) early_panic("node %s missing `reg' property\n", name); + if ( len < dt_cells_to_size(address_cells + size_cells) ) + early_panic("fdt: node `%s': `reg` property length is too short\n", + name); + cell = (const u32 *)prop->data; device_tree_get_reg(&cell, address_cells, size_cells, &mod->start, &mod->size); -- 1.7.10.4