Skip to contentSkip to conversation

Fix crash with poorly defined #size-cells

PATCH Applied Jack Miller 2 participants 2 messages Apr 29, 2015 – Apr 30, 2015 1 message not in the archive

lore
Share & tools
lore

Jack Miller

author
#0 lore raw

PATCH 1/1 Fix crash with poorly defined #size-cells

If you have a parent block with #size-cells improperly set to 0, and then subsequently try to include a regs property in the child, dtc will crash with SIGFPE while validating it. This patch fixes that crash, instead printing the same invalid length warning that was causing it.

Test included.

Signed-off-by Jack Miller <[email protected]>
---
 checks.c                 |  2 +-
 tests/bad-size-cells.dts | 12 ++++++++++++
 tests/run_tests.sh       |  2 ++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 tests/bad-size-cells.dts
checks.c +1 -1
index e81a8c7..0c03ac9 100644
@@ -560,7 +560,7 @@ static void check_reg_format(struct check *c, struct node *dt,
 	size_cells = node_size_cells(node->parent);
 	entrylen = (addr_cells + size_cells) * sizeof(cell_t);
 
-	if ((prop->val.len % entrylen) != 0)
+	if (!entrylen || (prop->val.len % entrylen) != 0)
 		FAIL(c, "\"reg\" property in %s has invalid length (%d bytes) "
 		     "(#address-cells == %d, #size-cells == %d)",
 		     node->fullpath, prop->val.len, addr_cells, size_cells);
tests/bad-size-cells.dts new file +12 -0
new file mode 100644
index 0000000..515c0cc
@@ -0,0 +1,12 @@
+/dts-v1/;
+
+/ {
+	mangled {
+		#address-cells = <0x0>;
+		#size-cells = <0x0>;
+
+		valid {
+            reg = <0x0 0x4000000>;
+        };
+    };
+};
tests/run_tests.sh +2 -0
index 5331856..c870432 100755
@@ -279,6 +279,8 @@ libfdt_tests () {
     run_dtc_test -I dts -O dtb -o embedded_nul.test.dtb embedded_nul.dts
     run_dtc_test -I dts -O dtb -o embedded_nul_equiv.test.dtb embedded_nul_equiv.dts
     run_test dtbs_equal_ordered embedded_nul.test.dtb embedded_nul_equiv.test.dtb
+
+    run_dtc_test -I dts -O dtb bad-size-cells.dts
 }
 
 dtc_tests () {
Signature · 1 line
2.3.6

A message that is not in the archive (sent off-list or not yet received): 1430334144-26986-1-git-send-email-jack-jZyo8ZIaZD9AfugRpC6u6w@public.gmane.org

Applied
#2 lore raw
Quoted 8 lines · Jack Miller

If you have a parent block with #size-cells improperly set to 0, and then subsequently try to include a regs property in the child, dtc will crash with SIGFPE while validating it. This patch fixes that crash, instead printing the same invalid length warning that was causing it.

Test included.

Signed-off-by Jack Miller <[email protected]>

Applied, thanks.

Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson