Re: [PATCH 1/2] of: reserved_mem: avoid stack buffer overflow in fdt_scan_reserved_mem()

[Rob Herring <robh@kernel.org>]

On Thu, Jun 04, 2026 at 05:18:09PM +0800, Wandun wrote:
> 
> 
> On 6/4/26 15:45, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [Medium] The newly added bounds check for `dynamic_nodes_cnt` is placed outside the block that evaluates whether a node is actually a dynamically-placed region, leading to spurious error logs.
> > --
> > 
> > commit 6a79f526de5e1185b7c79fb469545f4094fb402f
> > Author: Wandun Chen <chenwandun@lixiang.com>
> > 
> > of: reserved_mem: avoid stack buffer overflow in fdt_scan_reserved_mem()
> > 
> > This commit adds bounds checking on dynamic_nodes_cnt to prevent a
> > potential stack buffer overflow in fdt_scan_reserved_mem().
> > 
> > Link: https://sashiko.dev/#/patchset/20260604015332.3669384-1-chenwandun1%40gmail.com?part=1 [1]
> > 
> > > diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
> > > --- a/drivers/of/of_reserved_mem.c
> > > +++ b/drivers/of/of_reserved_mem.c
> > [ ... ]
> > 
> > > @@ -341,6 +341,12 @@ int __init fdt_scan_reserved_mem(void)
> > >   		err = __reserved_mem_reserve_reg(child, uname);
> > >   		if (!err)
> > >   			count++;
> > > +
> > > +		if (dynamic_nodes_cnt >= MAX_RESERVED_REGIONS) {
> > > +			pr_err_once("Reserved memory: reached MAX_RESERVED_REGIONS(%d)\n",
> > > +				    MAX_RESERVED_REGIONS);
> > > +			continue;
> > > +		}
> > [Severity: Medium]
> > Will this bounds check trigger spurious error logs for statically-placed
> > regions?
> Yes, it indeed, will fix in v2.

I now have the same change (and same problems) in another submission:

https://lore.kernel.org/all/20260603152709.941788-1-ekffu200098@gmail.com/

See my comment there.

Rob