Re: [PATCH v10 05/10] block: partitions: of: Attach partition fwnode to the block device

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] In `validate_of_partition` and `add_of_partition`, if the 'reg' property is not found, `of_get_property` returns `NULL` and leaves `len` uninitialized. This uninitialized `len` is then used in a length check, which may coincidentally pass, leading to a NULL pointer dereference.
--

--- Patch [5]: [PATCH v10 05/10] block: partitions: of: Attach partition fwnode to the block device ---
commit 84a9bb090d9a515321ec327f495f887813824601
Author: Loic Poulain <[email protected]>

block: partitions: of: Attach partition fwnode to the block device

This patch carries the partition's device tree node through the OF parser
and attaches it to the block device. This mirrors the whole-disk case and
allows consumers to look up per-partition properties in the device tree.

> diff --git a/block/partitions/of.c b/block/partitions/of.c
> index 53664ea06b654..4fc7c80c407de 100644
> --- a/block/partitions/of.c
> +++ b/block/partitions/of.c

[ ... ]

> @@ -62,6 +63,8 @@ static void add_of_partition(struct parsed_partitions *state, int slot,
>  		partname = of_get_property(np, "name", &len);
>  	strscpy(info->volname, partname, sizeof(info->volname));
>  
> +	state->parts[slot].fwnode = fwnode_handle_get(of_fwnode_handle(np));
> +

[Severity: High]
This is a pre-existing issue, but can this code path trigger a NULL
pointer dereference if the "reg" property is missing in the device tree?

Looking earlier in add_of_partition(), it calls of_get_property() for the
"reg" property:

	const __be32 *reg = of_get_property(np, "reg", &len);
	int a_cells = of_n_addr_cells(np);
	int s_cells = of_n_size_cells(np);

	/* Convert bytes to sector size */
	u64 offset = of_read_number(reg, a_cells) / SECTOR_SIZE;

If the "reg" property is not found, of_get_property() returns NULL and
leaves the len variable uninitialized.

The same pattern exists in validate_of_partition(). If the uninitialized
len variable happens to match the expected length, validate_of_partition()
could bypass its check, leading to of_read_number() unconditionally
dereferencing a NULL reg pointer.

Should there be an explicit check for reg != NULL before attempting to
read the offset?

>  	seq_buf_printf(&state->pp_buf, "(%s)", info->volname);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5