From a67a6ed15513541579d38bcbd127e7be170710e5 Mon Sep 17 00:00:00 2001 From: Laura Abbott Date: Thu, 19 Jun 2014 20:13:38 -0700 Subject: of: Check for phys_addr_t overflows in early_init_dt_add_memory_arch The common early_init_dt_add_memory_arch takes the base and size of a memory region as u64 types. The function never checks if the base and size can actually fit in a phys_addr_t which may be smaller than 64-bits. This may result in incorrect memory being passed to memblock_add if the memory falls outside the range of phys_addr_t. Add range checks for the base and size if phys_addr_t is smaller than u64. Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Laura Abbott Acked-by: Nicolas Pitre Signed-off-by: Grant Likely --- drivers/of/fdt.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c index c4cddf0cd96d..b777d8f46bd5 100644 --- a/drivers/of/fdt.c +++ b/drivers/of/fdt.c @@ -880,6 +880,21 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size) const u64 phys_offset = __pa(PAGE_OFFSET); base &= PAGE_MASK; size &= PAGE_MASK; + + if (sizeof(phys_addr_t) < sizeof(u64)) { + if (base > ULONG_MAX) { + pr_warning("Ignoring memory block 0x%llx - 0x%llx\n", + base, base + size); + return; + } + + if (base + size > ULONG_MAX) { + pr_warning("Ignoring memory range 0x%lx - 0x%llx\n", + ULONG_MAX, base + size); + size = ULONG_MAX - base; + } + } + if (base + size < phys_offset) { pr_warning("Ignoring memory block 0x%llx - 0x%llx\n", base, base + size); -- cgit v1.2.3