Re: [PATCH v3] of/address: Fix NULL bus dereference in of_pci_range_parser_one()
Rob Herring <[email protected]>
| Newsgroups | dev.linux.lists.sashiko-reviews,org.kernel.vger.linux-devicetree |
|---|---|
| Message-ID | <CAL_JsqJ2rqLzH3=vV8jzmTKorKvuVc-zqv-8+-T7K229ND8mow@mail.gmail.com> |
On Mon, Jul 27, 2026 at 3:47 AM Carlo Caione <[email protected]> wrote: > > On Mon Jul 27, 2026 at 10:46 AM CEST, sashiko-bot wrote: > > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: > > > > Pre-existing issues: > > - [High] An integer overflow in the calculation of `np` (`np = parser->pna + na + ns`) can be triggered by a maliciously crafted Device Tree with a large positive `#size-cells` value (e.g., `0x7FFFFFFE`). This results in a negative `np` which bypasses the bounds check `parser->range + np > parser->end`. > > [...] > > [Severity: High] > > This isn't a bug introduced by this patch, but can this integer calculation > > overflow? > > Not going to endless-ly fix pre-existing issues. Agreed. I'm not sure this one is worth "fixing". Rob