From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sergey Shtylyov <s.shtylyov@omp.ru>,
Rob Herring <robh@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.19 01/38] of: fdt: fix off-by-one error in unflatten_dt_nodes()
Date: Wed, 21 Sep 2022 17:45:45 +0200 [thread overview]
Message-ID: <20220921153646.345032150@linuxfoundation.org> (raw)
In-Reply-To: <20220921153646.298361220@linuxfoundation.org>
From: Sergey Shtylyov <s.shtylyov@omp.ru>
[ Upstream commit 2f945a792f67815abca26fa8a5e863ccf3fa1181 ]
Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
forgot to fix up the depth check in the loop body in unflatten_dt_nodes()
which makes it possible to overflow the nps[] buffer...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 520ed965bb7a..583ca847a39c 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -314,7 +314,7 @@ static int unflatten_dt_nodes(const void *blob,
for (offset = 0;
offset >= 0 && depth >= initial_depth;
offset = fdt_next_node(blob, offset, &depth)) {
- if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
+ if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1))
continue;
if (!IS_ENABLED(CONFIG_OF_KOBJ) &&
--
2.35.1
next prev parent reply other threads:[~2022-09-21 15:46 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-21 15:45 [PATCH 5.19 00/38] 5.19.11-rc1 review Greg Kroah-Hartman
2022-09-21 15:45 ` Greg Kroah-Hartman [this message]
2022-09-21 15:45 ` [PATCH 5.19 02/38] pinctrl: qcom: sc8180x: Fix gpio_wakeirq_map Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 03/38] pinctrl: qcom: sc8180x: Fix wrong pin numbers Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 04/38] pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 05/38] pinctrl: sunxi: Fix name for A100 R_PIO Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 06/38] SUNRPC: Fix call completion races with call_decode() Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 07/38] NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 08/38] gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 09/38] NFSv4.2: Update mode bits after ALLOCATE and DEALLOCATE Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 10/38] Revert "SUNRPC: Remove unreachable error condition" Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 11/38] drm/panel-edp: Fix delays for Innolux N116BCA-EA1 Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 12/38] drm/meson: Correct OSD1 global alpha value Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 13/38] drm/meson: Fix OSD1 RGB to YCbCr coefficient Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 14/38] drm/rockchip: vop2: Fix eDP/HDMI sync polarities Greg Kroah-Hartman
2022-09-21 15:45 ` [PATCH 5.19 15/38] drm/i915/vdsc: Set VDSC PIC_HEIGHT before using for DP DSC Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 16/38] drm/i915/guc: Dont update engine busyness stats too frequently Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 17/38] drm/i915/guc: Cancel GuC engine busyness worker synchronously Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 18/38] block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 19/38] parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 20/38] of/device: Fix up of_dma_configure_id() stub Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 21/38] io_uring/msg_ring: check file type before putting Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 22/38] cifs: revalidate mapping when doing direct writes Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 23/38] cifs: dont send down the destination address to sendmsg for a SOCK_STREAM Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 24/38] cifs: always initialize struct msghdr smb_msg completely Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 25/38] blk-lib: fix blkdev_issue_secure_erase Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 26/38] parisc: Allow CONFIG_64BIT with ARCH=parisc Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 27/38] tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 28/38] drm/i915/gt: Fix perf limit reasons bit positions Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 29/38] drm/i915: Set correct domains values at _i915_vma_move_to_active Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 30/38] drm/amdgpu: make sure to init common IP before gmc Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 31/38] drm/amdgpu: Dont enable LTR if not supported Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 32/38] drm/amdgpu: move nbio ih_doorbell_range() into ih code for vega Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 33/38] drm/amdgpu: move nbio sdma_doorbell_range() into sdma " Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 34/38] net: Find dst with sks xfrm policy not ctl_sk Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 35/38] dt-bindings: apple,aic: Fix required item "apple,fiq-index" in affinity description Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 36/38] cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 37/38] ALSA: hda/sigmatel: Keep power up while beep is enabled Greg Kroah-Hartman
2022-09-21 15:46 ` [PATCH 5.19 38/38] ALSA: hda/sigmatel: Fix unused variable warning for beep power change Greg Kroah-Hartman
2022-09-22 7:11 ` [PATCH 5.19 00/38] 5.19.11-rc1 review Bagas Sanjaya
2022-09-22 7:14 ` Bagas Sanjaya
2022-09-22 16:42 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220921153646.345032150@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=robh@kernel.org \
--cc=s.shtylyov@omp.ru \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).