From 4910cc250b4dab82b42a743377d359abaee07b73 Mon Sep 17 00:00:00 2001 From: Frank Rowand Date: Wed, 16 May 2018 21:19:51 -0700 Subject: [PATCH] of: overlay: validate offset from property fixups commit 482137bf2aecd887ebfa8756456764a2f6a0e545 upstream. The smatch static checker marks the data in offset as untrusted, leading it to warn: drivers/of/resolver.c:125 update_usages_of_a_phandle_reference() error: buffer underflow 'prop->value' 's32min-s32max' Add check to verify that offset is within the property data. Reported-by: Dan Carpenter Signed-off-by: Frank Rowand Cc: Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman --- drivers/of/resolver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c index 99309cb7d372..3bf4b6489fd0 100644 --- a/drivers/of/resolver.c +++ b/drivers/of/resolver.c @@ -129,6 +129,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay, goto err_fail; } + if (offset < 0 || offset + sizeof(__be32) > prop->length) { + err = -EINVAL; + goto err_fail; + } + *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle); } -- 2.20.1