Re: [PATCH] Fix crash due to processing "memory-controller" nodes as "memory"

[Anton Blanchard <anton@samba.org>]

Hi Ian,

> From: Ian Munsie <imunsie@au1.ibm.com>
> 
> If the system has a PCI device with a memory-controller device node,
> kexec-lite would spew hundreds of double free warnings and eventually
> segfault. This would result in a "kexec load failed" message from
> petitboot.
> 
> This was due to kexec_memory_map() searching for "memory" nodes, but
> actually matching any node that started with "memory", including these
> "memory-controller" nodes. This patch changes the search to look for
> nodes starting with "memory@", which should only match memory nodes.

Nice catch! I wonder if we should be checking for device_type
"memory". Ben?

Anton

> An example of a device tree that can trigger this bug is as follows:
> 
> {
> 	pciex@3fffe40000000 {
> 		...
> 		pci@0 {
> 			#address-cells = <0x3>;
> 			#size-cells = <0x2>;
> 			...
> 			memory-controller@0 {
> 				reg = <0x10000 0x0 0x0 0x0 0x0>;
> 				...
> 			};
> 		};
> 	};
> };
> 
> Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
> ---
>  kexec_memory_map.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kexec_memory_map.c b/kexec_memory_map.c
> index fc1b7af..7f18de7 100644
> --- a/kexec_memory_map.c
> +++ b/kexec_memory_map.c
> @@ -192,7 +192,7 @@ void kexec_memory_map(void *fdt, int
> reserve_initrd) 
>  		name = fdt_get_name(fdt, nodeoffset, NULL);
>  
> -		if (!name || strncmp(name, "memory",
> strlen("memory")))
> +		if (!name || strncmp(name, "memory@",
> strlen("memory@"))) continue;
>  
>  		reg = fdt_getprop(fdt, nodeoffset, "reg", &len);