[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH for-4.22] dom0less: Prevent division by zero in handle_passthrough_prop()
- To: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>
- Date: Tue, 7 Jul 2026 15:16:31 +0000
- Accept-language: en-US, uk-UA, ru-RU
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kRQt5BmN7D/iyyK46Ikpo+PNXru/dALXtPZtBI7Jja4=; b=LZSVdP3JN4pdLB4/ZjMKdbVH/e/P+EDp1rY9tC3j9RKtFUcB1Ti6qE3NR6+XvjYpqEWAcSOzNoztYe9xP/4oqOw+7aKCOp2rq8He5lTNUOao+8bpZ+regwo1JRorNmoair1xzU8+UggTCHsEilSNr3l/Jq3VoNTArKH8mpxFghT6sTkmIEScPIVhUrWGitzeLfFbePs/ZVRUHVV1bhWpz2inOrUhBMn3QSkLrXTSNmR4sg+cGExWRu4S+CTJ6nXJJhELUA6eH4AGCSnpLCh2vj8lSFxSZO7cqVFpDYDzJnEIbanPedudmQLqMUHLOEb5BwbMOutnG3hBVTzptdj+DQ==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uIFPCZDjV1YSlHtepxCV4vezJlAWBeeRJYJAluYs0Jy46vazuTtInzywGoxUnMcVNH9vJAomRusfIiau+beAvtPJU24SxIvg1AL1iuy5C7m7d2IIePSWIctGlz2Oms0Ys1z/swGpgKfhdhgBQ/LwBSAa+oFK2+8b5f9m1UOea4F/pKbaCvGSWCdHYVjk+h2/N+8MZugliwKEqW4QymL4EJsLJGczvfJfPZz94AF/rJii/JKFwC0W+Z75Ir6MdhFi7ONUwIR4WOV3lrcFzpSEmoA1COm2GHQ0PNuz3Rm4AnG2AAfqoG8bdUdp7uyOvgYB3PTaQuOWig0OuNkNcxyLTg==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>
- Delivery-date: Tue, 07 Jul 2026 15:16:45 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHdDiOX7r4PlObs6ESPVB8UpORlsw==
- Thread-topic: [PATCH for-4.22] dom0less: Prevent division by zero in handle_passthrough_prop()
A malformed provided partial DTB specifying both '#address-cells = <0>'
and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to
evaluate to 0. This sum is subsequently used as a divisor when calculating
the number of regions in the 'xen,reg' property:
len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) *
sizeof(uint32_t));
This leads to a division by zero exception in the Xen hypervisor during
boot, causing a hypervisor panic/crash.
Fix this by validating that '(address_cells * 2 + size_cells)' is greater
than zero before performing the division. If it is zero, log an error
message and return -EINVAL.
Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
---
xen/common/device-tree/dom0less-build.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/xen/common/device-tree/dom0less-build.c
b/xen/common/device-tree/dom0less-build.c
index eacfd93087..6796851844 100644
--- a/xen/common/device-tree/dom0less-build.c
+++ b/xen/common/device-tree/dom0less-build.c
@@ -154,6 +154,13 @@ static int __init handle_passthrough_prop(struct
kernel_info *kinfo,
/* xen,reg specifies where to map the MMIO region */
cell = (const __be32 *)xen_reg->data;
+
+ if ( (address_cells * 2 + size_cells) == 0 )
+ {
+ printk(XENLOG_ERR "Invalid address/size cells combination (both 0)\n");
+ return -EINVAL;
+ }
+
len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) *
sizeof(uint32_t));
--
2.43.0
|
