Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] misc: fastrpc: out-of-bounds read due to index underflow bypassing bounds check --
commit a9dd81ce5afe0b6b73eb7394627f61e8448d9435 Author: Vinayak Katoch <[email protected]> misc: fastrpc: handle multi-cell reg in context bank probe Platforms that use #address-cells = <2> on the fastrpc node encode the context bank number in cell[1] of the reg property rather than cell[0]. Reading cell[0] on such platforms yields 0 for every context bank, causing all sessions to share SID 0 and corrupting IOVA address construction. > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c > index b29c1fd00de28..5c7bb56cf46d0 100644 > --- a/drivers/misc/fastrpc.c > +++ b/drivers/misc/fastrpc.c > @@ -2348,7 +2348,8 @@ static int fastrpc_cb_init(struct platform_device *pdev) > if (!cctx) > return -EINVAL; > > - if (of_property_read_u32(dev->of_node, "reg", &sid)) > + if (of_property_read_u32_index(dev->of_node, "reg", > + of_n_addr_cells(dev->of_node) - 1, &sid)) [Severity: High] Can this code underflow the index if a malformed device tree explicitly sets #address-cells = <0> on the parent node? If of_n_addr_cells() evaluates to 0, the unchecked subtraction introduces an underflow. Because the index argument to of_property_read_u32_index() is a u32, this implicitly casts -1 to 0xFFFFFFFF. This propagates down to bypass bounds checking in the property reader: drivers/of/property.c:of_property_read_u32_index() { ... const u32 *val = of_find_property_value_of_size(np, propname, ((index + 1) * sizeof(*out_value)), 0, NULL); ... } The index + 1 expression wraps to 0 here, reducing the min size to 0 and defeating the internal length check inside of_find_property_value_of_size(). This subsequently triggers an out-of-bounds read when extracting the value: drivers/of/property.c:of_property_read_u32_index() { ... *out_value = be32_to_cpup(((__be32 *)val) + index); ... } This pointer arithmetic adds 0xFFFFFFFF to the base property address, resulting in an immediate out-of-bounds memory dereference traversing approximately 17 GB past the base pointer. > dev_info(dev, "FastRPC Session ID not specified in DT\n"); > > spin_lock_irqsave(&cctx->lock, flags); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
