On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> OF_getproplen() will return -1 if "reset-gpios" is not found which
> currently causes a panic:
>
> panic: malloc: allocation too large, type = 2, size = 4294967295
>
> Below is a fix.
There are more of these:
dev/ofw/ofw_regulator.c:336: if ((glen = OF_getproplen(node, "gpios")) <= 0)
dev/ofw/ofw_regulator.c:338: if ((slen = OF_getproplen(node, "states")) <= 0)
dev/ofw/ofw_regulator.c:401: if ((glen = OF_getproplen(node, "gpios")) <= 0)
dev/ofw/ofw_regulator.c:403: if ((slen = OF_getproplen(node, "states")) <= 0)
where glen and slen are size_t and
arch/sparc64/sparc64/pmap.c:806: sz = OF_getproplen(memh, "available") +
sizeof(struct mem_region);
with a size_t sz.
>
> ok?
>
> Index: mvpcie.c
> ===================================================================
> RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
> retrieving revision 1.5
> diff -u -p -r1.5 mvpcie.c
> --- mvpcie.c 24 Oct 2021 17:52:27 -0000 1.5
> +++ mvpcie.c 13 Feb 2022 13:24:17 -0000
> @@ -106,7 +106,7 @@ struct mvpcie_port {
> int po_fn;
>
> uint32_t *po_gpio;
> - size_t po_gpiolen;
> + int po_gpiolen;
>
> struct arm32_pci_chipset po_pc;
> int po_bus;
> @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
> po->po_bridge_iolimit = 1;
>
> po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
> - if (po->po_gpiolen) {
> + if (po->po_gpiolen > 0) {
> po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
> OF_getpropintarray(po->po_node, "reset-gpios",
> po->po_gpio, po->po_gpiolen);
>
