Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40f9938c authored by Pawel Moll's avatar Pawel Moll Committed by Rusty Russell
Browse files

virtio-mmio: Fix irq parsing in command line parameter 



When the resource_size_t is 64-bit long, the sscanf() on
the virtio device command line paramter string may return
wrong value because its format was defined as "%u". Fixed
by using an intermediate local value of a known length.

Also added cleaned up the resource creation and added extra
comments to make the parameters parsing easier to follow.

Reported-by: default avatarLee Jones <lee.jones@linaro.org>
Signed-off-by: default avatarPawel Moll <pawel.moll@arm.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent eb34f12b

drivers/virtio/virtio_mmio.c

+17 −9
Original line number Diff line number Diff line
@@ -521,25 +521,33 @@ static int vm_cmdline_set(const char *device, 
	int err;

	struct resource resources[2] = {};

	char *str;

	long long int base;

	long long int base, size;

	unsigned int irq;

	int processed, consumed = 0;

	struct platform_device *pdev;



	resources[0].flags = IORESOURCE_MEM;

	resources[1].flags = IORESOURCE_IRQ;



	resources[0].end = memparse(device, &str) - 1;

	/* Consume "size" part of the command line parameter */

	size = memparse(device, &str);



	/* Get "@<base>:<irq>[:<id>]" chunks */

	processed = sscanf(str, "@%lli:%u%n:%d%n",

			&base, &resources[1].start, &consumed,

			&base, &irq, &consumed,

			&vm_cmdline_id, &consumed);



	if (processed < 2 || processed > 3 || str[consumed])

	/*

	 * sscanf() must processes at least 2 chunks; also there

	 * must be no extra characters after the last chunk, so

	 * str[consumed] must be '\0'

	 */

	if (processed < 2 || str[consumed])

		return -EINVAL;



	resources[0].flags = IORESOURCE_MEM;

	resources[0].start = base;

	resources[0].end += base;

	resources[1].end = resources[1].start;

	resources[0].end = base + size - 1;



	resources[1].flags = IORESOURCE_IRQ;

	resources[1].start = resources[1].end = irq;



	if (!vm_cmdline_parent_registered) {

		err = device_register(&vm_cmdline_parent);