Skip to content
Commit 8c82d6ec authored by Robin Murphy's avatar Robin Murphy Committed by Joerg Roedel
Browse files

iommu/arm-smmu: Fix out-of-bounds dereference

When we iterate a master's config entries, what we generally care
about is the entry's stream map index, rather than the entry index
itself, so it's nice to have the iterator automatically assign the
former from the latter. Unfortunately, booting with KASAN reveals
the oversight that using a simple comma operator results in the
entry index being dereferenced before being checked for validity,
so we always access one element past the end of the fwspec array.

Flip things around so that the check always happens before the index
may be dereferenced.

Fixes: adfec2e7

 ("iommu/arm-smmu: Convert to iommu_fwspec")
Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
Acked-by: default avatarWill Deacon <will.deacon@arm.com>
Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 3c117b54
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment