diff options
| author | Julien Grall <julien.grall@linaro.org> | 2013-09-13 13:49:14 +0100 |
|---|---|---|
| committer | Ian Campbell <ian.campbell@citrix.com> | 2013-09-17 15:27:59 +0100 |
| commit | 1fccdfce51ec3367515f73c59765611ed67e747b (patch) | |
| tree | 974ab0c0ff5fc94e8f6090e1f8e84d2e820ae1a9 /xen/common | |
| parent | 57e835e51420bf1ff793524bbd815a85291c51e4 (diff) | |
| download | xen-1fccdfce51ec3367515f73c59765611ed67e747b.tar.gz xen-1fccdfce51ec3367515f73c59765611ed67e747b.tar.bz2 xen-1fccdfce51ec3367515f73c59765611ed67e747b.zip | |
xen/dts: Check "reg" property length in process_multiboot_node
The device tree compiler (dtc) will only warn if the "reg" property doesn't
match #address-cells and #size-cells size. It won't update the different
property. Therefore, Xen needs to check if the size match both properties,
otherwise Xen can retrieve a wrong range.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Diffstat (limited to 'xen/common')
| -rw-r--r-- | xen/common/device_tree.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/xen/common/device_tree.c b/xen/common/device_tree.c index f867dfd969..9d300ecb8f 100644 --- a/xen/common/device_tree.c +++ b/xen/common/device_tree.c @@ -467,10 +467,14 @@ static void __init process_multiboot_node(const void *fdt, int node, mod = &early_info.modules.module[nr]; - prop = fdt_get_property(fdt, node, "reg", NULL); + prop = fdt_get_property(fdt, node, "reg", &len); if ( !prop ) early_panic("node %s missing `reg' property\n", name); + if ( len < dt_cells_to_size(address_cells + size_cells) ) + early_panic("fdt: node `%s': `reg` property length is too short\n", + name); + cell = (const u32 *)prop->data; device_tree_get_reg(&cell, address_cells, size_cells, &mod->start, &mod->size); |