Re: [PATCH v3] of/address: Fix NULL bus dereference in of_pci_range_parser_one()
"Carlo Caione" <[email protected]>
| Newsgroups | dev.linux.lists.sashiko-reviews,org.kernel.vger.linux-devicetree |
|---|---|
| Message-ID | <[email protected]> |
On Mon Jul 27, 2026 at 10:46 AM CEST, sashiko-bot wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: > > Pre-existing issues: > - [High] An integer overflow in the calculation of `np` (`np = parser->pna + na + ns`) can be triggered by a maliciously crafted Device Tree with a large positive `#size-cells` value (e.g., `0x7FFFFFFE`). This results in a negative `np` which bypasses the bounds check `parser->range + np > parser->end`. [...] > [Severity: High] > This isn't a bug introduced by this patch, but can this integer calculation > overflow? Not going to endless-ly fix pre-existing issues. -- Carlo Caione