Re: [PATCH v2] mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
From: Jassi Brar
Date: Thu Sep 18 2025 - 19:26:18 EST
On Thu, Sep 18, 2025 at 7:55 AM Joonwon Kang <joonwonkang@xxxxxxxxxx> wrote:
>
> Although it is guided that `#mbox-cells` must be at least 1, there are
> many instances of `#mbox-cells = <0>;` in the device tree. If that is
> the case and the corresponding mailbox controller does not provide
> `of_xlate` function pointer, `of_mbox_index_xlate()` will be used by
> default and out-of-bounds accesses could occur due to lack of bounds
> check in that function.
>
OK, so we want of_mbox_index_xlate() to refuse if the channel's index
is not available, which
will be the case when #mbox-cells=<0> in dt and sp->args_count=0 here.
Fair enough.
I think the following details are unnecessary, maybe drop it.
Thanks