[Xen-changelog] [xen stable-4.5] xen: arm: bootfdt: Avoid reading off the front of *_cells array

[patchbot@xxxxxxx]

commit f72ab694c5a6143aac965e912351ae6350dd1089
Author:     Ian Campbell <ian.campbell@xxxxxxxxxx>
AuthorDate: Thu Jul 16 09:50:07 2015 +0100
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Fri Sep 25 13:37:08 2015 +0100

    xen: arm: bootfdt: Avoid reading off the front of *_cells array
    
    In device_tree_for_each_node the call to the callback was using
    {address,size}_cells[depth - 1], which at depth 0 could read off the
    front of the array.
    
    We already handled this correctly in the rest of the loop so fixup
    this instance as well.
    
    Reported-by: Chris (Christopher) Brand <chris.brand@xxxxxxxxxxxx>
    Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    Cc: Chris (Christopher) Brand <chris.brand@xxxxxxxxxxxx>
    Reviewed-by: Julien Grall <julien.grall@xxxxxxxxxx>
    (cherry picked from commit 989f3939bd16a0e1669c179b6c5c264812a25fc2)
---
 xen/arch/arm/bootfdt.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/xen/arch/arm/bootfdt.c b/xen/arch/arm/bootfdt.c
index e100233..74d208b 100644
--- a/xen/arch/arm/bootfdt.c
+++ b/xen/arch/arm/bootfdt.c
@@ -100,6 +100,7 @@ static int __init device_tree_for_each_node(const void *fdt,
           node = fdt_next_node(fdt, node, &depth) )
     {
         const char *name = fdt_get_name(fdt, node, NULL);
+        u32 as, ss;
 
         if ( depth >= DEVICE_TREE_MAX_DEPTH )
         {
@@ -108,14 +109,15 @@ static int __init device_tree_for_each_node(const void 
*fdt,
             continue;
         }
 
-        address_cells[depth] = device_tree_get_u32(fdt, node, "#address-cells",
-                                depth > 0 ? address_cells[depth-1] : 0);
-        size_cells[depth] = device_tree_get_u32(fdt, node, "#size-cells",
-                                depth > 0 ? size_cells[depth-1] : 0);
+        as = depth > 0 ? address_cells[depth-1] : 0;
+        ss = depth > 0 ? size_cells[depth-1] : 0;
 
+        address_cells[depth] = device_tree_get_u32(fdt, node,
+                                                   "#address-cells", as);
+        size_cells[depth] = device_tree_get_u32(fdt, node,
+                                                "#size-cells", ss);
 
-        ret = func(fdt, node, name, depth,
-                   address_cells[depth-1], size_cells[depth-1], data);
+        ret = func(fdt, node, name, depth, as, ss, data);
         if ( ret != 0 )
             return ret;
     }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog