aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--xen/common/device_tree.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/xen/common/device_tree.c b/xen/common/device_tree.c
index f867dfd969..9d300ecb8f 100644
--- a/xen/common/device_tree.c
+++ b/xen/common/device_tree.c
@@ -467,10 +467,14 @@ static void __init process_multiboot_node(const void *fdt, int node,
mod = &early_info.modules.module[nr];
- prop = fdt_get_property(fdt, node, "reg", NULL);
+ prop = fdt_get_property(fdt, node, "reg", &len);
if ( !prop )
early_panic("node %s missing `reg' property\n", name);
+ if ( len < dt_cells_to_size(address_cells + size_cells) )
+ early_panic("fdt: node `%s': `reg` property length is too short\n",
+ name);
+
cell = (const u32 *)prop->data;
device_tree_get_reg(&cell, address_cells, size_cells,
&mod->start, &mod->size);