Re: [PATCH v3 04/11] of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the `dynamic_nodes` stack array in `fdt_scan_reserved_mem()` has a fixed size of `MAX_RESERVED_REGIONS` and lacks a bounds check when storing dynamically-placed reserved memory regions, leading to a potential stack buffer overflow.
--

commit d26e031d55dfe0dd2c4b24bada22d27eff019795
Author: Wandun Chen <chenwandun@lixiang.com>

of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry

Prepare for storing /memreserve/ entries in the reserved_mem array.
Zero total_reserved_mem_cnt if no valid /reserved-memory entry exists,
instead of keeping its initial value. This allows accounting for
/memreserve entries in follow-up patches.

> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
> index 6d479381ff1fd..05defc91e9015 100644
> --- a/drivers/of/of_reserved_mem.c
> +++ b/drivers/of/of_reserved_mem.c
> @@ -329,11 +329,14 @@ int __init fdt_scan_reserved_mem(void)
>  	const void *fdt = initial_boot_params;
>  
>  	node = fdt_path_offset(fdt, "/reserved-memory");
> -	if (node < 0)
> +	if (node < 0) {
> +		total_reserved_mem_cnt = 0;
>  		return -ENODEV;
> +	}
>  
>  	if (__reserved_mem_check_root(node) != 0) {
>  		pr_err("Reserved memory: unsupported node format, ignoring\n");
> +		total_reserved_mem_cnt = 0;
>  		return -EINVAL;
>  	}

[Severity: High]
This is a pre-existing issue, but does this code overflow the dynamic_nodes[]
array?

Looking further down in the fdt_for_each_subnode() loop in
fdt_scan_reserved_mem():

		if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) {
			dynamic_nodes[dynamic_nodes_cnt] = child;
			dynamic_nodes_cnt++;
		}

The dynamic_nodes array is allocated on the stack with a fixed size of
MAX_RESERVED_REGIONS, but there doesn't appear to be a bounds check on
dynamic_nodes_cnt before saving dynamically-placed regions.

Could a misconfigured or malicious device tree with more than
MAX_RESERVED_REGIONS dynamically-placed regions cause an out-of-bounds
write on the stack during the device tree scan?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260527032917.3385849-1-chenwandun1@gmail.com?part=4