[PATCH 3/3] checks: Fix crash in graph_child_address if 'reg' cell size > 1

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



If an endpoint node has a 'reg' property which consists of more than
one cell and given that matching '#address-cells' and '#size-cells'
properties are specified on the port node an assertion is triggered in
check_graph_child_address() before the relevant diagnostic checks in
check_graph_reg() (called by check_graph_port()) are executed.

Example dts file triggering the issue:

/dts-v1/;
 / {
	bar: bar {
		port {
			bar_con: endpoint {
				remote-endpoint = <&foo_con>;
			};
		};
	};
	foo {
		port {
			#address-cells = <1>;
			#size-cells = <1>; // should always be 0
			foo_con: endpoint@1 {
				reg = <1 2>; // causes assertion failure instead of diagnostic
				remote-endpoint = <&bar_con>;
			};
		};
	};
};

Signed-off-by: Johannes Beisswenger <johannes.beisswenger@xxxxxxxxxxx>
---
 checks.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/checks.c b/checks.c
index 8ed7a60..4648c44 100644
--- a/checks.c
+++ b/checks.c
@@ -1798,8 +1798,10 @@ static void check_graph_child_address(struct check *c, struct dt_info *dti,
 		struct property *prop = get_property(child, "reg");
 
 		/* No error if we have any non-zero unit address */
-		if (prop && propval_cell(prop) != 0)
+		/* We have a check for val.len == sizeof(cell_t) elsewhere */
+                if (prop && propval_cell_n(prop, 0)  != 0 ) {
 			return;
+                }
 
 		cnt++;
 	}
-- 
2.40.0




[Index of Archives]     [Device Tree]     [Device Tree Spec]     [Linux Driver Backports]     [Video for Linux]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux