]> git.baikalelectronics.ru Git - kernel.git/commit
iommu/arm-smmu: Fix out-of-bounds dereference
authorRobin Murphy <robin.murphy@arm.com>
Mon, 7 Nov 2016 18:25:09 +0000 (18:25 +0000)
committerJoerg Roedel <jroedel@suse.de>
Tue, 8 Nov 2016 13:52:41 +0000 (14:52 +0100)
commit7788df172c0f4094f7f6bfd5f80f98c1d8c0a3f6
tree2f7cfe5ecec2af776e9514340a4f3e4746ad185a
parent202b7befc32908bd6b43563720b39d85dc1473dd
iommu/arm-smmu: Fix out-of-bounds dereference

When we iterate a master's config entries, what we generally care
about is the entry's stream map index, rather than the entry index
itself, so it's nice to have the iterator automatically assign the
former from the latter. Unfortunately, booting with KASAN reveals
the oversight that using a simple comma operator results in the
entry index being dereferenced before being checked for validity,
so we always access one element past the end of the fwspec array.

Flip things around so that the check always happens before the index
may be dereferenced.

Fixes: dc7e363da98c ("iommu/arm-smmu: Convert to iommu_fwspec")
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
drivers/iommu/arm-smmu.c