Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revert "of/irq: Prevent device address out-of-bounds read in interrupt map walk"

Browse source 
This reverts commit 017b0a488a.
This commit is contained in:
Ksawlii 2024-11-24 00:23:38 +01:00
parent bfd9345726
commit 0c4f581c2d
1 changed files with 4 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
drivers/of/irq.c
View file

@ -288,8 +288,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
struct device_node *p; struct device_node *p;
const __be32 *addr; const __be32 *addr;
u32 intsize; u32 intsize;
int i, res, addr_len; int i, res;
__be32 addr_buf[3] = { 0 };
pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index);
@ -298,19 +297,13 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
return of_irq_parse_oldworld(device, index, out_irq); return of_irq_parse_oldworld(device, index, out_irq);
/* Get the reg property (if any) */ /* Get the reg property (if any) */
addr = of_get_property(device, "reg", &addr_len); addr = of_get_property(device, "reg", NULL);
/* Prevent out-of-bounds read in case of longer interrupt parent address size */
if (addr_len > (3 * sizeof(__be32)))
addr_len = 3 * sizeof(__be32);
if (addr)
memcpy(addr_buf, addr, addr_len);
/* Try the new-style interrupts-extended first */ /* Try the new-style interrupts-extended first */
res = of_parse_phandle_with_args(device, "interrupts-extended", res = of_parse_phandle_with_args(device, "interrupts-extended",
"#interrupt-cells", index, out_irq); "#interrupt-cells", index, out_irq);
if (!res) if (!res)
return of_irq_parse_raw(addr_buf, out_irq); return of_irq_parse_raw(addr, out_irq);
/* Look for the interrupt parent. */ /* Look for the interrupt parent. */
p = of_irq_find_parent(device); p = of_irq_find_parent(device);
@ -340,7 +333,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
/* Check if there are any interrupt-map translations to process */ /* Check if there are any interrupt-map translations to process */
res = of_irq_parse_raw(addr_buf, out_irq); res = of_irq_parse_raw(addr, out_irq);
out: out:
of_node_put(p); of_node_put(p);
return res; return res;