redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

of: overlay: Fix out-of-bounds write in init_overlay_changeset() 

If an overlay has no "__symbols__" node, but it has nodes without
"__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
filling in all fragments for nodes with "__overlay__" subnodes,
"fragment = &fragments[cnt]" will point beyond the end of the allocated
array.

Hence writing to "fragment->overlay" will overwrite unallocated memory,
which may lead to a crash later.

Fix this by deferring both the assignment to "fragment" and the
offending write afterwards until we know for sure the node has an
"__overlay__" subnode, and thus a valid entry in "fragments[]".

Fixes: 61b4de4e0b ("of: overlay: minor restructuring")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rob Herring <robh@kernel.org>
hifive-unleashed-5.1
Geert Uytterhoeven 2017-12-08 14:13:02 +01:00 committed by Rob Herring
parent 5e4748175f
commit 35e691eddc
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/of/overlay.c
View File

@ -572,9 +572,10 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
cnt = 0;
for_each_child_of_node(tree, node) {
fragment = &fragments[cnt];
fragment->overlay = of_get_child_by_name(node, "__overlay__");
if (fragment->overlay) {
overlay_node = of_get_child_by_name(node, "__overlay__");
if (overlay_node) {
fragment = &fragments[cnt];
fragment->overlay = overlay_node;
fragment->target = find_target_node(node);
if (!fragment->target) {
of_node_put(fragment->overlay);