Re: [PATCH v3 4/5] of: reserved_mem: reject static regions overlapping no-map memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] of: reserved_mem: integer overflow in rmem_overlaps_check bypasses overlap detection
--

commit bab4bcea3e71f149872f45d815c003c14a811a0a
Author: Wandun Chen <chenwandun@lixiang.com>

of: reserved_mem: reject static regions overlapping no-map memory

This commit updates the reserved memory initialization to reject static no-map
regions that overlap with existing reserved no-map memory. It also skips
no-map regions during the late scan if they overlap with already reserved
ones, preventing multiple drivers from mapping the same physical memory.

Link: https://sashiko.dev/#/message/20260814084718.29C341F000E9%40smtp.kernel.org [1]

> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
> index 3a6c6dbfd7b11..8d2057f2ac12e 100644
> --- a/drivers/of/of_reserved_mem.c
> +++ b/drivers/of/of_reserved_mem.c

[ ... ]

> @@ -266,6 +267,20 @@ static void __init __rmem_check_for_overlap(void)
>  	}
>  }
>  
> +static bool __init rmem_overlaps_check(phys_addr_t base, phys_addr_t size,
> +				       int start)
> +{
> +	int i;
> +
> +	for (i = start; i < reserved_mem_count; i++) {
> +		struct reserved_mem *r = &reserved_mem[i];
> +
> +		if (memblock_addrs_overlap(base, size, r->base, r->size))
> +			return true;

[Severity: High]
Does this code allow an integer wrap-around to bypass the overlap check?

The size variable read from the device tree is used without being bounded by
memblock_cap_size() before calling memblock_addrs_overlap().

If a crafted device tree or overlay defines a static reserved memory node
with a size large enough to cause base + size to wrap around phys_addr_t,
the internal addition in memblock_addrs_overlap() could wrap. This would
cause it to incorrectly return false, bypassing this overlap check.

The region then reaches memblock_is_region_rsrv_rmem(), which does cap the
size and finds the valid overlap marked by an earlier valid region, allowing
multiple reserved memory regions to be mapped to the exact same physical
memory.

> +	}
> +	return false;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920092852.614973-1-chenwandun1@gmail.com?part=4