Re: [PATCH v4 03/10] of: reserved_mem: skip late scan when no regions are reserved

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `dynamic_nodes` array in `fdt_scan_reserved_mem()` has a fixed size of `MAX_RESERVED_REGIONS` (64) but lacks bounds checking, leading to a potential stack buffer overflow.
--

commit e62a55f3fff119a2e88f5aefe6dbf1cf5ef32c31
Author: Wandun Chen <chenwandun@lixiang.com>

of: reserved_mem: skip late scan when no regions are reserved

This commit optimizes reserved memory initialization by skipping the
late scan when no reserved regions exist. It updates
alloc_reserved_mem_array() to return -ENODEV directly if
total_reserved_mem_cnt is 0.

> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
> index 42649dc3613f0..e1bd35115cc1e 100644
> --- a/drivers/of/of_reserved_mem.c
> +++ b/drivers/of/of_reserved_mem.c
> @@ -76,7 +76,7 @@ static int __init alloc_reserved_mem_array(void)
>  	int ret;
>  
>  	if (!total_reserved_mem_cnt)
> -		return 0;
> +		return -ENODEV;
>  
>  	alloc_size = array_size(total_reserved_mem_cnt, sizeof(*new_array));

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the reserved
memory changes, I noticed a potential issue in the nearby
fdt_scan_reserved_mem() function.

Does this code overflow dynamic_nodes[] if the device tree contains more
than MAX_RESERVED_REGIONS dynamic regions?

drivers/of/of_reserved_mem.c:fdt_scan_reserved_mem() {
	int dynamic_nodes_cnt = 0;
	int dynamic_nodes[MAX_RESERVED_REGIONS];
...
	if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) {
		dynamic_nodes[dynamic_nodes_cnt] = child;
		dynamic_nodes_cnt++;
	}
...
}

If a malformed Flattened Device Tree is provided with more than 64 dynamically
allocated reserved memory regions, it looks like dynamic_nodes_cnt could
increment past the bounds of the array, leading to stack corruption.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630074715.4126796-1-chenwandun1@gmail.com?part=3