Re: [PATCH for-4.22] dom0less: Prevent division by zero in handle_passthrough_prop()

[Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>]

On 7/7/26 5:16 PM, Dmytro Prokopchuk1 wrote:
> A malformed provided partial DTB specifying both '#address-cells = <0>'
> and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to
> evaluate to 0. This sum is subsequently used as a divisor when calculating
> the number of regions in the 'xen,reg' property:
>
>      len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) *
>                                          sizeof(uint32_t));
>
> This leads to a division by zero exception in the Xen hypervisor during
> boot, causing a hypervisor panic/crash.
>
> Fix this by validating that '(address_cells * 2 + size_cells)' is greater
> than zero before performing the division. If it is zero, log an error
> message and return -EINVAL.
Fix tag is missed.
> Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
> ---
>   xen/common/device-tree/dom0less-build.c | 7 +++++++
>   1 file changed, 7 insertions(+)
>
> diff --git a/xen/common/device-tree/dom0less-build.c 
> b/xen/common/device-tree/dom0less-build.c
> index eacfd93087..6796851844 100644
> --- a/xen/common/device-tree/dom0less-build.c
> +++ b/xen/common/device-tree/dom0less-build.c
> @@ -154,6 +154,13 @@ static int __init handle_passthrough_prop(struct 
> kernel_info *kinfo,
>   
>       /* xen,reg specifies where to map the MMIO region */
>       cell = (const __be32 *)xen_reg->data;
> +
> +    if ( (address_cells * 2 + size_cells) == 0 )
Considering that this calculation happens second time here ...

> +    {
> +        printk(XENLOG_ERR "Invalid address/size cells combination (both 0)\n");
> +        return -EINVAL;
> +    }
> +
>       len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) *
>                                           sizeof(uint32_t));
... I think it would be nice to calculate that once.

Generally I am okay to not declare local separate variable for these 
calculations.
With adding Fix tag:
 Reviewed-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
 Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>

Thanks.

~ Oleksii