Re: [PATCH v3] of/address: Fix NULL bus dereference in of_pci_range_parser_one()

From: Rob Herring (Arm)

Date: Tue Jul 28 2026 - 11:46:22 EST



On Mon, 27 Jul 2026 10:36:59 +0200, Carlo Caione wrote:
> The bus matching rework made of_match_bus() return NULL for nodes with
> ranges/dma-ranges but no local #address-cells. parser_init() stored that
> NULL bus, and the range iterator later dereferenced it.
>
> Reject such nodes in parser_init(), leaving an explicit empty
> iterator for callers that ignore the init return, and make
> of_dma_get_max_cpu_address() honour the init failure so a rejected node
> cannot clamp the DMA limit.
>
> Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Carlo Caione <ccaione@xxxxxxxxxxxx>
> ---
> Changes in v3:
> - Drop the of_range_count() hunk in of_dma_get_max_cpu_address(): it
> guarded a pre-existing corner, not this regression (Rob)
> - Link to v2: https://lore.kernel.org/r/20260706114731.57353-1-ccaione@xxxxxxxxxxxx
>
> Changes in v2:
> - Validate na/pna/ns in parser_init() with OF_CHECK_COUNTS() /
> OF_CHECK_ADDR_COUNT()
> - Link to v1: https://lore.kernel.org/r/20260706095651.48839-1-ccaione@xxxxxxxxxxxx
> ---
> drivers/of/address.c | 22 ++++++++++++++++------
> 1 file changed, 16 insertions(+), 6 deletions(-)
>

Applied, thanks!