Skip to content
Commit 1856f50c authored by Christophe Jaillet's avatar Christophe Jaillet Committed by Michael Ellerman
Browse files

powerpc/prom: Avoid reference to potentially freed memory



of_get_property() is used inside the loop, but then the reference to the
node is dropped before dereferencing the prop pointer, which could by then
point to junk if the node has been freed.

Instead use of_property_read_u32() to actually read the property
value before dropping the reference.

of_property_read_u32() requires at least one cell (u32) to be present,
which is stricter than the old logic which would happily dereference a
property of any size. However we believe all device trees in the wild
have at least one cell.

Skiboot may produce memory nodes with more than one cell, but that is
OK, of_property_read_u32() will return the first one.

Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
[mpe: Expand change log with device tree details]
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent bed08b7e
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment