Re: [PATCH v3] MIPS: mm: Fix out-of-bounds write in maar_res_walk()

[Thomas Bogendoerfer <tsbogend@alpha.franken.de>]

On Tue, May 26, 2026 at 05:20:09PM +0800, Yadan Fan wrote:
> >From 8dda685e7d0d1653cfb2a93d0865a1fa5a561700 Mon Sep 17 00:00:00 2001
> From: Yadan Fan <ydfan@suse.com>
> Date: Mon, 25 May 2026 12:04:36 +0800
> Subject: [PATCH v3] MIPS: mm: Fix out-of-bounds write in maar_res_walk()
> 
> maar_res_walk() uses wi->num_cfg as the index into the fixed-size
> wi->cfg array, but checks whether the array is full only after it has
> filled the selected entry. If walk_system_ram_range() reports more than
> 16 memory ranges, the overflow call writes one struct maar_config past
> the end of the array before WARN_ON() prevents num_cfg from advancing.
> 
> Move the full-array check before taking the array slot and return non-zero
> when the scratch array is full, so walk_system_ram_range() terminates the
> walk instead of invoking the callback for further ranges.
> 
> Fixes: a5718fe8f70f ("MIPS: mm: Drop boot_mem_map")
> 
> Signed-off-by: Yadan Fan <ydfan@suse.com>
> ---
> Changes in v3:
>   - Restore to use WARN_ON() with return -1 to stop
>     walk_system_ram_range() walking further
> 
>  arch/mips/mm/init.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)

applied to mips-next

Thomas.

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea.                                                [ RFC1925, 2.3 ]