Messages in this thread Patch in this message | | | From | Greg Kroah-Hartman <> | Subject | [PATCH 4.17 078/220] of: overlay: validate offset from property fixups | Date | Sun, 1 Jul 2018 18:21:42 +0200 |
| |
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Rowand <frank.rowand@sony.com>
commit 482137bf2aecd887ebfa8756456764a2f6a0e545 upstream.
The smatch static checker marks the data in offset as untrusted, leading it to warn:
drivers/of/resolver.c:125 update_usages_of_a_phandle_reference() error: buffer underflow 'prop->value' 's32min-s32max'
Add check to verify that offset is within the property data.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Frank Rowand <frank.rowand@sony.com> Cc: <stable@vger.kernel.org> Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- drivers/of/resolver.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/drivers/of/resolver.c +++ b/drivers/of/resolver.c @@ -122,6 +122,11 @@ static int update_usages_of_a_phandle_re goto err_fail; } + if (offset < 0 || offset + sizeof(__be32) > prop->length) { + err = -EINVAL; + goto err_fail; + } + *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle); }
| |