Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Although it is guided that `#mbox-cells` must be at least 1, there are
many instances of `#mbox-cells = <0>;` in the device tree. If that is
the case and the corresponding mailbox controller does not provide
`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will
be used by default and out-of-bounds accesses could occur due to lack of
bounds check in that function.

Cc: stable@vger.kernel.org
Signed-off-by: Joonwon Kang <joonwonkang@google.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>

authored by

Joonwon Kang and committed by
Jassi Brar
fcd7f96c b562abd9

+2 -4
+2 -4
drivers/mailbox/mailbox.c
··· 489 489 static struct mbox_chan *fw_mbox_index_xlate(struct mbox_controller *mbox, 490 490 const struct fwnode_reference_args *sp) 491 491 { 492 - int ind = sp->args[0]; 493 - 494 - if (ind >= mbox->num_chans) 492 + if (sp->nargs < 1 || sp->args[0] >= mbox->num_chans) 495 493 return ERR_PTR(-EINVAL); 496 494 497 - return &mbox->chans[ind]; 495 + return &mbox->chans[sp->args[0]]; 498 496 } 499 497 500 498 /**