]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
authorJoonwon Kang <joonwonkang@google.com>
Wed, 26 Nov 2025 06:22:50 +0000 (06:22 +0000)
committerJassi Brar <jassisinghbrar@gmail.com>
Sun, 18 Jan 2026 18:50:45 +0000 (12:50 -0600)
commitfcd7f96c783626c07ee3ed75fa3739a8a2052310
treee71affe20ab3fbfa53dd7bc560f4ac4995d04c4f
parentb562abd956726f57bb78813b4c77db51d28933a9
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Although it is guided that `#mbox-cells` must be at least 1, there are
many instances of `#mbox-cells = <0>;` in the device tree. If that is
the case and the corresponding mailbox controller does not provide
`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will
be used by default and out-of-bounds accesses could occur due to lack of
bounds check in that function.

Cc: stable@vger.kernel.org
Signed-off-by: Joonwon Kang <joonwonkang@google.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
drivers/mailbox/mailbox.c