iommu/arm-smmu: Fix out-of-bounds dereference
When we iterate a master's config entries, what we generally care about is the entry's stream map index, rather than the entry index itself, so it's nice to have the iterator automatically assign the former from the latter. Unfortunately, booting with KASAN reveals the oversight that using a simple comma operator results in the entry index being dereferenced before being checked for validity, so we always access one element past the end of the fwspec array. Flip things around so that the check always happens before the index may be dereferenced. Change-Id: Ifad076d88f51c8e27db3ae1208d70b0733800ce7 Fixes: adfec2e7 ("iommu/arm-smmu: Convert to iommu_fwspec") Reported-by:Mark Rutland <mark.rutland@arm.com> Signed-off-by:
Robin Murphy <robin.murphy@arm.com> Acked-by:
Will Deacon <will.deacon@arm.com> Signed-off-by:
Joerg Roedel <jroedel@suse.de> Git-commit: 8c82d6ec Git-repo: https://source.codeaurora.org/quic/la/kernel/msm-4.4 Signed-off-by:
Patrick Daly <pdaly@codeaurora.org>
Loading
Please register or sign in to comment