aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGeert Uytterhoeven <geert+renesas@glider.be>2017-12-08 14:13:02 +0100
committerRob Herring <robh@kernel.org>2017-12-08 09:32:10 -0600
commit35e691eddca565f475ba69ff84ca0c9db3b3257b (patch)
tree9f317f1df3badfd882e93412bff8475abbaff013
parent5e4748175fe942c86cbab840e2fa41a92b4d6cf6 (diff)
downloadlinux-stericsson-35e691eddca565f475ba69ff84ca0c9db3b3257b.tar.gz
of: overlay: Fix out-of-bounds write in init_overlay_changeset()
If an overlay has no "__symbols__" node, but it has nodes without "__overlay__" subnodes at the end (e.g. a "__fixups__" node), after filling in all fragments for nodes with "__overlay__" subnodes, "fragment = &fragments[cnt]" will point beyond the end of the allocated array. Hence writing to "fragment->overlay" will overwrite unallocated memory, which may lead to a crash later. Fix this by deferring both the assignment to "fragment" and the offending write afterwards until we know for sure the node has an "__overlay__" subnode, and thus a valid entry in "fragments[]". Fixes: 61b4de4e0b384f4a ("of: overlay: minor restructuring") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rob Herring <robh@kernel.org>
-rw-r--r--drivers/of/overlay.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index fcce5cdbe229..83bb2edfc65c 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -572,9 +572,10 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
cnt = 0;
for_each_child_of_node(tree, node) {
- fragment = &fragments[cnt];
- fragment->overlay = of_get_child_by_name(node, "__overlay__");
- if (fragment->overlay) {
+ overlay_node = of_get_child_by_name(node, "__overlay__");
+ if (overlay_node) {
+ fragment = &fragments[cnt];
+ fragment->overlay = overlay_node;
fragment->target = find_target_node(node);
if (!fragment->target) {
of_node_put(fragment->overlay);