Re: [PATCH 1/2] of: reserved_mem: avoid stack buffer overflow in fdt_scan_reserved_mem()

[Wandun <chenwandun1@gmail.com>]

On 6/5/26 03:30, Rob Herring wrote:
> On Thu, Jun 04, 2026 at 05:18:09PM +0800, Wandun wrote:
>>
>> On 6/4/26 15:45, sashiko-bot@kernel.org wrote:
>>> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>>> - [Medium] The newly added bounds check for `dynamic_nodes_cnt` is placed outside the block that evaluates whether a node is actually a dynamically-placed region, leading to spurious error logs.
>>> --
>>>
>>> commit 6a79f526de5e1185b7c79fb469545f4094fb402f
>>> Author: Wandun Chen <chenwandun@lixiang.com>
>>>
>>> of: reserved_mem: avoid stack buffer overflow in fdt_scan_reserved_mem()
>>>
>>> This commit adds bounds checking on dynamic_nodes_cnt to prevent a
>>> potential stack buffer overflow in fdt_scan_reserved_mem().
>>>
>>> Link: https://sashiko.dev/#/patchset/20260604015332.3669384-1-chenwandun1%40gmail.com?part=1 [1]
>>>
>>>> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
>>>> --- a/drivers/of/of_reserved_mem.c
>>>> +++ b/drivers/of/of_reserved_mem.c
>>> [ ... ]
>>>
>>>> @@ -341,6 +341,12 @@ int __init fdt_scan_reserved_mem(void)
>>>>    		err = __reserved_mem_reserve_reg(child, uname);
>>>>    		if (!err)
>>>>    			count++;
>>>> +
>>>> +		if (dynamic_nodes_cnt >= MAX_RESERVED_REGIONS) {
>>>> +			pr_err_once("Reserved memory: reached MAX_RESERVED_REGIONS(%d)\n",
>>>> +				    MAX_RESERVED_REGIONS);
>>>> +			continue;
>>>> +		}
>>> [Severity: Medium]
>>> Will this bounds check trigger spurious error logs for statically-placed
>>> regions?
>> Yes, it indeed, will fix in v2.
> I now have the same change (and same problems) in another submission:
>
> https://lore.kernel.org/all/20260603152709.941788-1-ekffu200098@gmail.com/
>
> See my comment there.
Thanks for pointing out the other submission. Since the same fix is 
already being worked on, I'll drop this patch. Best regards, Wandun
>
> Rob