4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Rowand frank.rowand@sony.com
commit 482137bf2aecd887ebfa8756456764a2f6a0e545 upstream.
The smatch static checker marks the data in offset as untrusted, leading it to warn:
drivers/of/resolver.c:125 update_usages_of_a_phandle_reference() error: buffer underflow 'prop->value' 's32min-s32max'
Add check to verify that offset is within the property data.
Reported-by: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: Frank Rowand frank.rowand@sony.com Cc: stable@vger.kernel.org Signed-off-by: Rob Herring robh@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/of/resolver.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/drivers/of/resolver.c +++ b/drivers/of/resolver.c @@ -122,6 +122,11 @@ static int update_usages_of_a_phandle_re goto err_fail; }
+ if (offset < 0 || offset + sizeof(__be32) > prop->length) { + err = -EINVAL; + goto err_fail; + } + *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle); }