Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-14 Thread Theo Buehler
On Mon, Feb 14, 2022 at 12:00:24PM +1100, Jonathan Gray wrote:
> On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > > currently causes a panic:
> > > 
> > > panic: malloc: allocation too large, type = 2, size = 4294967295
> > > 
> > > Below is a fix.
> > 
> > There are more of these:
> > 
> > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > 
> > where glen and slen are size_t and

Thanks.

ok

> 
> Index: ofw_regulator.c
> ===
> RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v
> retrieving revision 1.15
> diff -u -p -r1.15 ofw_regulator.c
> --- ofw_regulator.c   23 Dec 2020 11:58:36 -  1.15
> +++ ofw_regulator.c   14 Feb 2022 00:55:28 -
> @@ -328,8 +328,7 @@ regulator_gpio_get(int node)
>  {
>   uint32_t *gpio, *gpios, *states;
>   uint32_t idx, value;
> - size_t glen, slen;
> - int i;
> + int glen, slen, i;
>  
>   pinctrl_byname(node, "default");
>  
> @@ -377,10 +376,9 @@ int
>  regulator_gpio_set(int node, uint32_t value)
>  {
>   uint32_t *gpio, *gpios, *states;
> - size_t glen, slen;
>   uint32_t min, max;
>   uint32_t idx;
> - int i;
> + int glen, slen, i;
>  
>   pinctrl_byname(node, "default");
>  



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-14 Thread Tobias Heider
On Mon, Feb 14, 2022 at 12:00:24PM +1100, Jonathan Gray wrote:
> On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > > currently causes a panic:
> > > 
> > > panic: malloc: allocation too large, type = 2, size = 4294967295
> > > 
> > > Below is a fix.
> > 
> > There are more of these:
> > 
> > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > 
> > where glen and slen are size_t and

ok tobhe@

> 
> Index: ofw_regulator.c
> ===
> RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v
> retrieving revision 1.15
> diff -u -p -r1.15 ofw_regulator.c
> --- ofw_regulator.c   23 Dec 2020 11:58:36 -  1.15
> +++ ofw_regulator.c   14 Feb 2022 00:55:28 -
> @@ -328,8 +328,7 @@ regulator_gpio_get(int node)
>  {
>   uint32_t *gpio, *gpios, *states;
>   uint32_t idx, value;
> - size_t glen, slen;
> - int i;
> + int glen, slen, i;
>  
>   pinctrl_byname(node, "default");
>  
> @@ -377,10 +376,9 @@ int
>  regulator_gpio_set(int node, uint32_t value)
>  {
>   uint32_t *gpio, *gpios, *states;
> - size_t glen, slen;
>   uint32_t min, max;
>   uint32_t idx;
> - int i;
> + int glen, slen, i;
>  
>   pinctrl_byname(node, "default");
>  



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Jonathan Gray
On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > currently causes a panic:
> > 
> > panic: malloc: allocation too large, type = 2, size = 4294967295
> > 
> > Below is a fix.
> 
> There are more of these:
> 
> dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= 
> 0)
> dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= 
> 0)
> dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= 
> 0)
> dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= 
> 0)
> 
> where glen and slen are size_t and

Index: ofw_regulator.c
===
RCS file: /cvs/src/sys/dev/ofw/ofw_regulator.c,v
retrieving revision 1.15
diff -u -p -r1.15 ofw_regulator.c
--- ofw_regulator.c 23 Dec 2020 11:58:36 -  1.15
+++ ofw_regulator.c 14 Feb 2022 00:55:28 -
@@ -328,8 +328,7 @@ regulator_gpio_get(int node)
 {
uint32_t *gpio, *gpios, *states;
uint32_t idx, value;
-   size_t glen, slen;
-   int i;
+   int glen, slen, i;
 
pinctrl_byname(node, "default");
 
@@ -377,10 +376,9 @@ int
 regulator_gpio_set(int node, uint32_t value)
 {
uint32_t *gpio, *gpios, *states;
-   size_t glen, slen;
uint32_t min, max;
uint32_t idx;
-   int i;
+   int glen, slen, i;
 
pinctrl_byname(node, "default");
 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Mark Kettenis
> Date: Mon, 14 Feb 2022 01:41:45 +1100
> From: Jonathan Gray 
> 
> On Mon, Feb 14, 2022 at 01:31:57AM +1100, Jonathan Gray wrote:
> > On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> > > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > > > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > > > currently causes a panic:
> > > > 
> > > > panic: malloc: allocation too large, type = 2, size = 4294967295
> > > > 
> > > > Below is a fix.
> > > 
> > > There are more of these:
> > > 
> > > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) 
> > > <= 0)
> > > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, 
> > > "states")) <= 0)
> > > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) 
> > > <= 0)
> > > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, 
> > > "states")) <= 0)
> > > 
> > > where glen and slen are size_t and
> > > 
> > > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, 
> > > "available") + sizeof(struct mem_region);
> > > 
> > > with a size_t sz.
> > 
> > another in imxspi
> 
> some more
> 
> ssdfb.c has a size_t sc_gpiolen but stores the
> result in a ssize_t and tests that before storing to it

ok kettenis@

> Index: dev/fdt/simpleamp.c
> ===
> RCS file: /cvs/src/sys/dev/fdt/simpleamp.c,v
> retrieving revision 1.1
> diff -u -p -r1.1 simpleamp.c
> --- dev/fdt/simpleamp.c   10 Jun 2020 23:59:07 -  1.1
> +++ dev/fdt/simpleamp.c   13 Feb 2022 14:35:09 -
> @@ -42,7 +42,7 @@ struct simpleamp_softc {
>   struct dai_device   sc_dai;
>  
>   uint32_t*sc_gpio;
> - size_t  sc_gpiolen;
> + int sc_gpiolen;
>   uint32_tsc_vcc;
>  };
>  
> Index: arch/arm64/dev/aplhidev.c
> ===
> RCS file: /cvs/src/sys/arch/arm64/dev/aplhidev.c,v
> retrieving revision 1.4
> diff -u -p -r1.4 aplhidev.c
> --- arch/arm64/dev/aplhidev.c 11 Dec 2021 20:36:26 -  1.4
> +++ arch/arm64/dev/aplhidev.c 13 Feb 2022 14:33:57 -
> @@ -117,7 +117,7 @@ struct aplhidev_softc {
>   uint8_t sc_msgid;
>  
>   uint32_t*sc_gpio;
> - size_t  sc_gpiolen;
> + int sc_gpiolen;
>  
>   struct device   *sc_kbd;
>   uint8_t sc_kbddesc[APLHIDEV_DESC_MAX];
> 
> 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Mark Kettenis
> Date: Mon, 14 Feb 2022 01:31:57 +1100
> From: Jonathan Gray 
> 
> On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > > currently causes a panic:
> > > 
> > > panic: malloc: allocation too large, type = 2, size = 4294967295
> > > 
> > > Below is a fix.
> > 
> > There are more of these:
> > 
> > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > 
> > where glen and slen are size_t and
> > 
> > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, 
> > "available") + sizeof(struct mem_region);
> > 
> > with a size_t sz.
> 
> another in imxspi

ok kettenis@

> Index: imxspi.c
> ===
> RCS file: /cvs/src/sys/dev/fdt/imxspi.c,v
> retrieving revision 1.3
> diff -u -p -r1.3 imxspi.c
> --- imxspi.c  31 Oct 2021 15:12:00 -  1.3
> +++ imxspi.c  13 Feb 2022 14:21:01 -
> @@ -91,7 +91,7 @@ struct imxspi_softc {
>   int  sc_node;
>  
>   uint32_t*sc_gpio;
> - size_t   sc_gpiolen;
> + int  sc_gpiolen;
>  
>   struct rwlocksc_buslock;
>   struct spi_controllersc_tag;
> @@ -179,7 +179,7 @@ imxspi_attachhook(struct device *self)
>   clock_enable(sc->sc_node, NULL);
>  
>   sc->sc_gpiolen = OF_getproplen(sc->sc_node, "cs-gpios");
> - if (sc->sc_gpiolen) {
> + if (sc->sc_gpiolen > 0) {
>   sc->sc_gpio = malloc(sc->sc_gpiolen, M_DEVBUF, M_WAITOK);
>   OF_getpropintarray(sc->sc_node, "cs-gpios",
>   sc->sc_gpio, sc->sc_gpiolen);
> 
> 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Jonathan Gray
On Mon, Feb 14, 2022 at 01:31:57AM +1100, Jonathan Gray wrote:
> On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> > On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > > currently causes a panic:
> > > 
> > > panic: malloc: allocation too large, type = 2, size = 4294967295
> > > 
> > > Below is a fix.
> > 
> > There are more of these:
> > 
> > dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) 
> > <= 0)
> > dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) 
> > <= 0)
> > 
> > where glen and slen are size_t and
> > 
> > arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, 
> > "available") + sizeof(struct mem_region);
> > 
> > with a size_t sz.
> 
> another in imxspi

some more

ssdfb.c has a size_t sc_gpiolen but stores the
result in a ssize_t and tests that before storing to it

Index: dev/fdt/simpleamp.c
===
RCS file: /cvs/src/sys/dev/fdt/simpleamp.c,v
retrieving revision 1.1
diff -u -p -r1.1 simpleamp.c
--- dev/fdt/simpleamp.c 10 Jun 2020 23:59:07 -  1.1
+++ dev/fdt/simpleamp.c 13 Feb 2022 14:35:09 -
@@ -42,7 +42,7 @@ struct simpleamp_softc {
struct dai_device   sc_dai;
 
uint32_t*sc_gpio;
-   size_t  sc_gpiolen;
+   int sc_gpiolen;
uint32_tsc_vcc;
 };
 
Index: arch/arm64/dev/aplhidev.c
===
RCS file: /cvs/src/sys/arch/arm64/dev/aplhidev.c,v
retrieving revision 1.4
diff -u -p -r1.4 aplhidev.c
--- arch/arm64/dev/aplhidev.c   11 Dec 2021 20:36:26 -  1.4
+++ arch/arm64/dev/aplhidev.c   13 Feb 2022 14:33:57 -
@@ -117,7 +117,7 @@ struct aplhidev_softc {
uint8_t sc_msgid;
 
uint32_t*sc_gpio;
-   size_t  sc_gpiolen;
+   int sc_gpiolen;
 
struct device   *sc_kbd;
uint8_t sc_kbddesc[APLHIDEV_DESC_MAX];



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Mark Kettenis
> Date: Sun, 13 Feb 2022 14:30:21 +0100
> From: Tobias Heider 
> 
> OF_getproplen() will return -1 if "reset-gpios" is not found which
> currently causes a panic:
> 
> panic: malloc: allocation too large, type = 2, size = 4294967295
> 
> Below is a fix.
> 
> ok?

ok kettenis@

> Index: mvpcie.c
> ===
> RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
> retrieving revision 1.5
> diff -u -p -r1.5 mvpcie.c
> --- mvpcie.c  24 Oct 2021 17:52:27 -  1.5
> +++ mvpcie.c  13 Feb 2022 13:24:17 -
> @@ -106,7 +106,7 @@ struct mvpcie_port {
>   int  po_fn;
>  
>   uint32_t*po_gpio;
> - size_t   po_gpiolen;
> + int  po_gpiolen;
>  
>   struct arm32_pci_chipset po_pc;
>   int  po_bus;
> @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
>   po->po_bridge_iolimit = 1;
>  
>   po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
> - if (po->po_gpiolen) {
> + if (po->po_gpiolen > 0) {
>   po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
>   OF_getpropintarray(po->po_node, "reset-gpios",
>   po->po_gpio, po->po_gpiolen);
> 
> 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Jonathan Gray
On Sun, Feb 13, 2022 at 03:17:27PM +0100, Theo Buehler wrote:
> On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > currently causes a panic:
> > 
> > panic: malloc: allocation too large, type = 2, size = 4294967295
> > 
> > Below is a fix.
> 
> There are more of these:
> 
> dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= 
> 0)
> dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= 
> 0)
> dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= 
> 0)
> dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= 
> 0)
> 
> where glen and slen are size_t and
> 
> arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, "available") 
> + sizeof(struct mem_region);
> 
> with a size_t sz.

another in imxspi

Index: imxspi.c
===
RCS file: /cvs/src/sys/dev/fdt/imxspi.c,v
retrieving revision 1.3
diff -u -p -r1.3 imxspi.c
--- imxspi.c31 Oct 2021 15:12:00 -  1.3
+++ imxspi.c13 Feb 2022 14:21:01 -
@@ -91,7 +91,7 @@ struct imxspi_softc {
int  sc_node;
 
uint32_t*sc_gpio;
-   size_t   sc_gpiolen;
+   int  sc_gpiolen;
 
struct rwlocksc_buslock;
struct spi_controllersc_tag;
@@ -179,7 +179,7 @@ imxspi_attachhook(struct device *self)
clock_enable(sc->sc_node, NULL);
 
sc->sc_gpiolen = OF_getproplen(sc->sc_node, "cs-gpios");
-   if (sc->sc_gpiolen) {
+   if (sc->sc_gpiolen > 0) {
sc->sc_gpio = malloc(sc->sc_gpiolen, M_DEVBUF, M_WAITOK);
OF_getpropintarray(sc->sc_node, "cs-gpios",
sc->sc_gpio, sc->sc_gpiolen);



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Theo Buehler
On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> OF_getproplen() will return -1 if "reset-gpios" is not found which
> currently causes a panic:
> 
> panic: malloc: allocation too large, type = 2, size = 4294967295
> 
> Below is a fix.

There are more of these:

dev/ofw/ofw_regulator.c:336:if ((glen = OF_getproplen(node, "gpios")) <= 0)
dev/ofw/ofw_regulator.c:338:if ((slen = OF_getproplen(node, "states")) <= 0)
dev/ofw/ofw_regulator.c:401:if ((glen = OF_getproplen(node, "gpios")) <= 0)
dev/ofw/ofw_regulator.c:403:if ((slen = OF_getproplen(node, "states")) <= 0)

where glen and slen are size_t and

arch/sparc64/sparc64/pmap.c:806:sz = OF_getproplen(memh, "available") + 
sizeof(struct mem_region);

with a size_t sz.

> 
> ok?
> 
> Index: mvpcie.c
> ===
> RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
> retrieving revision 1.5
> diff -u -p -r1.5 mvpcie.c
> --- mvpcie.c  24 Oct 2021 17:52:27 -  1.5
> +++ mvpcie.c  13 Feb 2022 13:24:17 -
> @@ -106,7 +106,7 @@ struct mvpcie_port {
>   int  po_fn;
>  
>   uint32_t*po_gpio;
> - size_t   po_gpiolen;
> + int  po_gpiolen;
>  
>   struct arm32_pci_chipset po_pc;
>   int  po_bus;
> @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
>   po->po_bridge_iolimit = 1;
>  
>   po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
> - if (po->po_gpiolen) {
> + if (po->po_gpiolen > 0) {
>   po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
>   OF_getpropintarray(po->po_node, "reset-gpios",
>   po->po_gpio, po->po_gpiolen);
> 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Patrick Wildt
Am Sun, Feb 13, 2022 at 01:39:22PM + schrieb Klemens Nanni:
> On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> > OF_getproplen() will return -1 if "reset-gpios" is not found which
> > currently causes a panic:
> > 
> > panic: malloc: allocation too large, type = 2, size = 4294967295
> > 
> > Below is a fix.
> > 
> > ok?
> 
> OK kn

ok patrick@ as well

> > 
> > Index: mvpcie.c
> > ===
> > RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
> > retrieving revision 1.5
> > diff -u -p -r1.5 mvpcie.c
> > --- mvpcie.c24 Oct 2021 17:52:27 -  1.5
> > +++ mvpcie.c13 Feb 2022 13:24:17 -
> > @@ -106,7 +106,7 @@ struct mvpcie_port {
> > int  po_fn;
> >  
> > uint32_t*po_gpio;
> > -   size_t   po_gpiolen;
> > +   int  po_gpiolen;
> >  
> > struct arm32_pci_chipset po_pc;
> > int  po_bus;
> > @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
> > po->po_bridge_iolimit = 1;
> >  
> > po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
> > -   if (po->po_gpiolen) {
> > +   if (po->po_gpiolen > 0) {
> > po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
> > OF_getpropintarray(po->po_node, "reset-gpios",
> > po->po_gpio, po->po_gpiolen);
> > 
> 



Re: mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Klemens Nanni
On Sun, Feb 13, 2022 at 02:30:21PM +0100, Tobias Heider wrote:
> OF_getproplen() will return -1 if "reset-gpios" is not found which
> currently causes a panic:
> 
> panic: malloc: allocation too large, type = 2, size = 4294967295
> 
> Below is a fix.
> 
> ok?

OK kn
> 
> Index: mvpcie.c
> ===
> RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
> retrieving revision 1.5
> diff -u -p -r1.5 mvpcie.c
> --- mvpcie.c  24 Oct 2021 17:52:27 -  1.5
> +++ mvpcie.c  13 Feb 2022 13:24:17 -
> @@ -106,7 +106,7 @@ struct mvpcie_port {
>   int  po_fn;
>  
>   uint32_t*po_gpio;
> - size_t   po_gpiolen;
> + int  po_gpiolen;
>  
>   struct arm32_pci_chipset po_pc;
>   int  po_bus;
> @@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
>   po->po_bridge_iolimit = 1;
>  
>   po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
> - if (po->po_gpiolen) {
> + if (po->po_gpiolen > 0) {
>   po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
>   OF_getpropintarray(po->po_node, "reset-gpios",
>   po->po_gpio, po->po_gpiolen);
> 



mvpcie(4): fix panic if "reset-gpios" is not available

2022-02-13 Thread Tobias Heider
OF_getproplen() will return -1 if "reset-gpios" is not found which
currently causes a panic:

panic: malloc: allocation too large, type = 2, size = 4294967295

Below is a fix.

ok?

Index: mvpcie.c
===
RCS file: /mount/openbsd/cvs/src/sys/arch/armv7/marvell/mvpcie.c,v
retrieving revision 1.5
diff -u -p -r1.5 mvpcie.c
--- mvpcie.c24 Oct 2021 17:52:27 -  1.5
+++ mvpcie.c13 Feb 2022 13:24:17 -
@@ -106,7 +106,7 @@ struct mvpcie_port {
int  po_fn;
 
uint32_t*po_gpio;
-   size_t   po_gpiolen;
+   int  po_gpiolen;
 
struct arm32_pci_chipset po_pc;
int  po_bus;
@@ -353,7 +353,7 @@ mvpcie_port_attach(struct mvpcie_softc *
po->po_bridge_iolimit = 1;
 
po->po_gpiolen = OF_getproplen(po->po_node, "reset-gpios");
-   if (po->po_gpiolen) {
+   if (po->po_gpiolen > 0) {
po->po_gpio = malloc(po->po_gpiolen, M_DEVBUF, M_WAITOK);
OF_getpropintarray(po->po_node, "reset-gpios",
po->po_gpio, po->po_gpiolen);