github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

of: reserved_mem: prevent OOB when too many dynamic regions are defined

Browse Source 
On boot, fdt_scan_reserved_mem() saves each dynamically-placed
/reserved-memory subnode into a local array of size
MAX_RESERVED_REGIONS.

If the device tree defines more than MAX_RESERVED_REGIONS
dynamically-placed regions, fdt_scan_reserved_mem() writes past the
end of the local array.

Add a bounds check that logs an error and skips the excess regions,
restoring the original behavior.

Fixes: 8a6e02d0c0 ("of: reserved_mem: Restructure how the reserved memory regions are processed")
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260614133807.2165124-2-ekffu200098@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
This commit is contained in:
Sang-Heon Jeon 2026-06-14 22:38:06 +09:00 committed by Rob Herring (Arm)
parent dc59e4fea9
commit db3dbdfea1
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/of/of_reserved_mem.c
View File

@ -359,6 +359,7 @@ int __init fdt_scan_reserved_mem(void)
err = __reserved_mem_reserve_reg(child, uname);
if (!err)
count++;
/*
* Save the nodes for the dynamically-placed regions
* into an array which will be used for allocation right
@ -366,10 +367,17 @@ int __init fdt_scan_reserved_mem(void)
* or marked as no-map. This is done to avoid dynamically
* allocating from one of the statically-placed regions.
*/
if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) {
dynamic_nodes[dynamic_nodes_cnt] = child;
dynamic_nodes_cnt++;
if (err != -ENOENT || !of_get_flat_dt_prop(child, "size", NULL))
continue;
if (dynamic_nodes_cnt == MAX_RESERVED_REGIONS) {
pr_err("too many defined dynamic regions, skip '%s'\n",
uname);
continue;
}
dynamic_nodes[dynamic_nodes_cnt] = child;
dynamic_nodes_cnt++;
}
for (int i = 0; i < dynamic_nodes_cnt; i++) {
const char *uname;