From: Julien Grall <julien.grall@linaro.org>
Date: Fri, 13 Sep 2013 12:49:14 +0000 (+0100)
Subject: xen/dts: Check "reg" property length in process_multiboot_node
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~6353
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=1fccdfce51ec3367515f73c59765611ed67e747b;p=xen.git

xen/dts: Check "reg" property length in process_multiboot_node

The device tree compiler (dtc) will only warn if the "reg" property doesn't
match #address-cells and #size-cells size. It won't update the different
property. Therefore, Xen needs to check if the size match both properties,
otherwise Xen can retrieve a wrong range.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---

diff --git a/xen/common/device_tree.c b/xen/common/device_tree.c
index f867dfd969..9d300ecb8f 100644
--- a/xen/common/device_tree.c
+++ b/xen/common/device_tree.c
@@ -467,10 +467,14 @@ static void __init process_multiboot_node(const void *fdt, int node,
 
     mod = &early_info.modules.module[nr];
 
-    prop = fdt_get_property(fdt, node, "reg", NULL);
+    prop = fdt_get_property(fdt, node, "reg", &len);
     if ( !prop )
         early_panic("node %s missing `reg' property\n", name);
 
+    if ( len < dt_cells_to_size(address_cells + size_cells) )
+        early_panic("fdt: node `%s': `reg` property length is too short\n",
+                    name);
+
     cell = (const u32 *)prop->data;
     device_tree_get_reg(&cell, address_cells, size_cells,
                         &mod->start, &mod->size);