From nobody Thu Jul 23 21:54:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass(p=quarantine dis=none) header.from=epam.com ARC-Seal: i=2; a=rsa-sha256; t=1783600333; cv=pass; d=zohomail.com; s=zohoarc; b=m7F5xyeD3F5BCOLPchKJ6s25swEl2gc5Qn1blV/mVqHv6xb4RF4e2Df91xyDZ1yfFTHH2WXQSiU/4lH9NLAzQlauAWYE0C8rRvvZaL9/EXHnXk3RzN0fZnIwElK/YWy6bphc/BC/BKPt0zps+A1JBOyVmtgCsDnN0k1HmzBL14o= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783600333; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mms2V30MltA9AZj5FU0MdVVfu/1AsbSX2lJZeLlLKDY=; b=LeF1K/gu1khPxOXVmqiAD8wqiGLDCV96pqxxrBNJGBN9aKgzcVrGeKkGapIYyWJOqEnhxdJYUFzSK1eFffVmJIEuc2R/WQhR03trHopkSr4G2H2UwrktNCipKiZBa/VgENXp3KQ0rWYpbPrx1Xpz+C6aT9fYE/nPw8/5/vJ0vGg= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1783600333776463.33660059846204; Thu, 9 Jul 2026 05:32:13 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1358105.1612372 (Exim 4.92) (envelope-from ) id 1whnuq-00018a-6H; Thu, 09 Jul 2026 12:31:44 +0000 Received: by outflank-mailman (output) from mailman id 1358105.1612372; Thu, 09 Jul 2026 12:31:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whnuq-00018T-3j; Thu, 09 Jul 2026 12:31:44 +0000 Received: by outflank-mailman (input) for mailman id 1358105; Thu, 09 Jul 2026 12:31:42 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whnuo-00018N-LC for xen-devel@lists.xenproject.org; Thu, 09 Jul 2026 12:31:42 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1whnuo-00EtOe-0L for xen-devel@lists.xenproject.org; Thu, 09 Jul 2026 14:31:42 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a4f94a0-5cb7-0a2a0a5109dd-0a2a4501d5be-32 for ; Thu, 09 Jul 2026 14:31:41 +0200 Received: from [52.101.70.77] (helo=AS8PR04CU009.outbound.protection.outlook.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.2) (envelope-from ) id 6a4f94ad-3ea4-0a2a45010019-3465464d68c4-3 for ; Thu, 09 Jul 2026 14:31:41 +0200 Received: from AM9PR03MB7526.eurprd03.prod.outlook.com (2603:10a6:20b:3de::17) by PA4PR03MB7135.eurprd03.prod.outlook.com (2603:10a6:102:ec::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.15; Thu, 9 Jul 2026 12:31:39 +0000 Received: from AM9PR03MB7526.eurprd03.prod.outlook.com ([fe80::904d:5820:80e1:41ba]) by AM9PR03MB7526.eurprd03.prod.outlook.com ([fe80::904d:5820:80e1:41ba%5]) with mapi id 15.21.0181.014; Thu, 9 Jul 2026 12:31:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HJxfpbbHHOSg2U451wWYnqorbDhVjfUuj1k1TpL5ISlMehXtX/nX/gHocZUBzb8C2lpWkmjSfzMQgR1Uffktpj0yvdD3QQqF212UBDl207UaQ0+SJnuBpLoWYhZ06BkI3kkfIyNY9QWegg9bhqGceukBjM4VaT3AWdiX1vE/0dIitPq4wHBfzO4sS/3vS8YmcOckylB8+BHY7QEkTfOc0nnrf4HrWBQFG2XfxH228Oqviidncx4TTYtpgapJYUKbxTfMP/yt5NHoHsM350Eqm0iiHXC03A5hX7vGwBl4rZ7YM80ycaVRhHAxyGX0gxXdstryjIzOXHISQ2XqjD5/hQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=mms2V30MltA9AZj5FU0MdVVfu/1AsbSX2lJZeLlLKDY=; b=ZcaGsUlbh19mXWhit+UusUMny27es3/pkY7t8zSkSvaZvLROWdqf3WHXip0TwcjO1NrZhQfLIw1TzhtBDrnEGVkaMThYgZ0e9mnpSgWsgDRiemmpo+MhsMh3ks9bC306QH2daHxG0yFnvZg9ZFai3Tw/j7Ye3UJXt8Y5Yq3z2nzHtljqRYiN8PI1IsXRaSi7ijX/CwK4lTVy0QqE2WkFPHlpB0prExT56VRjiLH7HBNOjse76INPb5oy+Cv7PfR7O2FD60dpgerA3cfyeaALpcdKKvT/viN7JOP6Iv+LRKfymfeu0cgtm0mvA55pv2ZgmqRx+l0777Kr9hMZx8Kdag== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mms2V30MltA9AZj5FU0MdVVfu/1AsbSX2lJZeLlLKDY=; b=ZTqvbdNJJTaoUEDnNbyrwzKFA7aJIP0nN0HDJNADAuPGg2bzdbkxubTK0mZ8/az4YOTRKLaFfpc2tTKc0HomjVwPfPhzdJyLTaon8AiRkQQSj6GBuFj9Lh5A+REfYeXtBZr8cDJbsRGps7fePwlhlkhu9QU8mf9KqfyHsG6klf39nJNr5ptoqY1AcEFwi3zivSUrTg95y97vxoEDVhOYnkWvzsoJXYURDi5p0qvVKPIqinQNyIQMbcDQKkAqw0i+h51xyInYdUvLIw4W2mryjzyqTnCj/jO7/KxJ/YtuLvW/qRwgBM6pHHxCCi76t4xnYhKmeDhhS8ORBr3Boz57Xw== From: Dmytro Prokopchuk1 To: "xen-devel@lists.xenproject.org" CC: Dmytro Prokopchuk1 , Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel Subject: [PATCH for-4.22 v5] dom0less: Prevent division by zero in handle_passthrough_prop() Thread-Topic: [PATCH for-4.22 v5] dom0less: Prevent division by zero in handle_passthrough_prop() Thread-Index: AQHdD57jetXi2xq2zkS8tff7r9QcYA== Date: Thu, 9 Jul 2026 12:31:38 +0000 Message-ID: <7a146536c13431933899ffffc93c85724dfbaf87.1783599357.git.dmytro_prokopchuk1@epam.com> Accept-Language: en-US, uk-UA, ru-RU Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AM9PR03MB7526:EE_|PA4PR03MB7135:EE_ x-ms-office365-filtering-correlation-id: 2ba52dd9-c0c7-42dd-e9bb-08deddb60614 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|42112799006|366016|38070700021|3023799007|56012099006|11063799006|18002099003; x-microsoft-antispam-message-info: w+hnUMUXVuMLEulLO4DKeChiFODWIm08qp2p82c1rLG9dLozn63kwDPafwUkZgqPxxlbrFsEcPkGc6PVUZPptdrak4U+/1STIXRDFygHcXf+XgMUBw3fc/xzy2wVsVbttKQSD62kLumjaTeaxpm8LUWB1rnyLwEWowsIWsQ7QHLm2XMZZhSGjYEPfhTqadHoB9xTmOSjEdTjMS1ngxTMlU+O5oI7XzC1YhJOyvPDer44ZXItG3i1xme8bRdok13sKl3uwiwTa09w5h3sE5A3/uukfeJ/ZoLBofyv6APpIvmkAscxAwGtme0ljRrEXC9s2Z4jZFJhaG/meWWFIRLjclo70P2InflJY29JjQCflTZw2YG2vFGvVaRZvgOK6kFZO/fB6aE/34VnBiJSXA2Ma4fyB17Zl3nDGM2xshLMWU3lzaF+n52pFQ81Vj1zbPGd9HgqS6BKCavJejz43JtT81hLMCrXukfty3/8+p3NUfamwHT3Zj0qqYFMMj/U5xaTofedMbSIJ1/O6gHZO86seiGgraxt6DYkj9jkp5giOciBM2kc+7LNfnj0TNBYn1v2RjsO9qSWNtQbPlf5mlLgD8JiBL0+bdeBpnUKl3rVEzu0beAXbTToI65pFBE5Ax1wQHVtZrQHrze82YMu7GC8M7wJYzzkVUA2FMp+o4Do1G/+UjRaxvnEekXxfID6smYu1+fwCOTTbtSskgNUfEXN1FbFMA/DZ4tQW5NIiBlw/Bo= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9PR03MB7526.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(42112799006)(366016)(38070700021)(3023799007)(56012099006)(11063799006)(18002099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?2jYoiGlYKgPUlMqheAHFgYDbfas1wTP4ZLgBiSPnCDARA6k3A6LjesmqZi?= =?iso-8859-1?Q?Q2yKDdoZnZNPZI4gMQyLIuVI/HZAruxWYndk9cDtm7crTIdVKbDXeLJiCp?= =?iso-8859-1?Q?2XhDDlKRabOtHK+b/XTFVKijS082Kf+Xwe0X6YK9YZPvpz42nHbH8aUH3z?= =?iso-8859-1?Q?gEl6TowZU42LVQ4CBjKFZ682n+DYMfHJU3jU0ziGdL38cGj36n9e0nmxPR?= =?iso-8859-1?Q?s4VDnpxwe76VsadAKl0DXSYZYMeI8LMrBxBRkvlcRcgbKA4eWOKxn7Pd1d?= =?iso-8859-1?Q?eEDfbm0l/ltaiLJbOg+GoNLtHgYL0L/AVtTdKTNBoZdv0fqjJGWE7EKMEK?= =?iso-8859-1?Q?//YRQnO7vxrgxRaFf6A7/sY6Falfy3fFgNBED61rPRqEjTcxWJl4LwJGA6?= =?iso-8859-1?Q?9u1xDkj8OF8NCQW5SuuRbVeTVN7o5sOP22JXaLlhzssURukzIxW1Aclejo?= =?iso-8859-1?Q?cQdOrM4kdRYXpb20rCuBxMmarN/wqArdJ2+9CtVeN5KAR5sIB4icm3NVts?= =?iso-8859-1?Q?o+iRRS2yRVPyOubpPPg441J5mZTgfLWAx0J//2Z6+H36yP+51aCRyHwOPl?= =?iso-8859-1?Q?td3tNhAai/vuGqM7J1IpMivHWIYHp8I+lI0olBhh1IwQya5iYXckiyB0Jb?= =?iso-8859-1?Q?H+D5yoeSXFZxvMPdvvNY++he6uKeET8x1xfwf28wgBkl3I7L0WcVPelx1t?= =?iso-8859-1?Q?GR1pEsJe1A1JpeuMRhpiXktoMmDEN1PDM4MsDl2JC8Omh0IFOF2xgSx+zy?= =?iso-8859-1?Q?x4pfkA1L2stBM4UlX/9GwU05ORKxQ2Ns/hhHm7gM/YPaLyLSdXguQbXLPf?= =?iso-8859-1?Q?e7cZe7OEv/M2RJo+uBsoPdAy8dTSy9nV9RMzuLTNjev8zLAnyf8fuz3UDi?= =?iso-8859-1?Q?Cv9aqIvq2Ad1mhYJ7lro36G7D9oS+zag5bNkw3mBjwcY7GDs7vnEDZfsYp?= =?iso-8859-1?Q?jLPaT3VomEAgBT8+8jEdqySICj6+aL2z+Z6yA4An/Y8vjSgWjbYXOx+wDQ?= =?iso-8859-1?Q?CetUFaAZed5q4tTWLWmsF9VkF0+gEzjjf2a+bZS+PuwbfteGzSZxtRNISh?= =?iso-8859-1?Q?vsgvGJE9zwOFahxKKBeJZ7pVKa/lBruWxRDjeP9xnIWFJwT4COd0pVE8zA?= =?iso-8859-1?Q?/kG7iyX+Vdm6G1X6CnJjOPwiCB0LzM/VCzxKqxKsRAZtoo8RJ+apzLeKzD?= =?iso-8859-1?Q?ml54Igofq2dAkw8zIsPOTDo6I4RGoHqW3XjP7YLALNq1s8CHKewDRH9mmd?= =?iso-8859-1?Q?ATBhwMRiN7OTvmMPbPxz1o+RpR2R2UfXxBayJu8Bk4s9ZsSBtBaBXrAJyj?= =?iso-8859-1?Q?NpjaUkdfuD46TR8Ac3m00m+oCZIb9UY8xitJTCWzVgPQZtuu0LydCpQdg4?= =?iso-8859-1?Q?jhJknzStcpWUbKFZFA9PcPnuh0GBxTvvtZms5PyzSCPLYRkz5pz9XBK2O0?= =?iso-8859-1?Q?+QM2K4IAG7zyiOuvsE+kmC7qxP8GhvStd77WWiJnJ3ggXzjRVsSs8lE/3S?= =?iso-8859-1?Q?95aqR2Wz7nf3GFQis+IlLXoMxQKYQBqUJkgF8gaWtnLGpIKxzQHqXcjCX3?= =?iso-8859-1?Q?g9KG84JwPKzAmm5eQb1dGn2wvf8B9jM2Hcy7mYzT/elpr3wSFXj3V4NEa+?= =?iso-8859-1?Q?L3/EK4vfUyY3HIB4sBoItauFGkKmbv656E6nrwyiPQ0WvP00HZc/UABQ6L?= =?iso-8859-1?Q?pHPXqvNSk8k+CtW3ygg0H0ma+l+t5p8LX2k3jQXxoj8JclVgxO8nsWtUPv?= =?iso-8859-1?Q?ltTBWCV0kGK/PmxmvHwP7tnuc5wLh5p/1qz11xJyj4I3VtsII3Z2xn4r/I?= =?iso-8859-1?Q?r3bdWjsx+EKOXR3a/U4u7oUHXU11f4Q=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM9PR03MB7526.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2ba52dd9-c0c7-42dd-e9bb-08deddb60614 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jul 2026 12:31:38.8836 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: vxRwrpyLMDnpAJp1rGJDB8QGyuxhHpryFlxfNFaKPRlXOwSYZr1/FXWvvfTfI/iJNucOKhFptFW5NMLjZEseAn+79t1xlXlbc72KCpaFtvY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR03MB7135 X-purgate-ID: tlsNG-d62444/1783600301-3DEEE0A8-9777C43B/0/0 X-purgate-type: clean X-purgate-size: 2082 X-ZohoMail-DKIM: pass (identity @epam.com) X-ZM-MESSAGEID: 1783600336543158500 Content-Type: text/plain; charset="utf-8" A malformed partial DTB specifying both '#address-cells =3D <0>' and '#size-cells =3D <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len =3D fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the valid range of [1, 2] at the read side in scan_pfdt_node() immediately after they are parsed. Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk --- Changes in v5: - fixed mistakes around dprintk() Test CI pipeline: https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/2664600678 --- xen/common/device-tree/dom0less-build.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tr= ee/dom0less-build.c index eacfd93087..c054ea4e2f 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -341,6 +341,14 @@ static int __init scan_pfdt_node(struct kernel_info *k= info, const void *pfdt, size_cells =3D device_tree_get_u32(pfdt, nodeoff, "#size-cells", DT_ROOT_NODE_SIZE_CELLS_DEFAULT); =20 + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + dprintk(XENLOG_ERR, "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + node_next =3D fdt_first_subnode(pfdt, nodeoff); while ( node_next > 0 ) { --=20 2.43.0