diff options
| author |   Geert Uytterhoeven <geert+renesas@glider.be> | 2017-12-08 14:13:02 +0100 |
|---|---|---|
| committer |   Rob Herring <robh@kernel.org> | 2017-12-08 09:32:10 -0600 |
| commit | 35e691eddca565f475ba69ff84ca0c9db3b3257b (patch) | |
| tree | 9f317f1df3badfd882e93412bff8475abbaff013 /Documentation | |
| parent | of: overlay: Fix (un)locking in of_overlay_apply() (diff) | |
| download | linux-dev-35e691eddca565f475ba69ff84ca0c9db3b3257b.tar.xz linux-dev-35e691eddca565f475ba69ff84ca0c9db3b3257b.zip | |
of: overlay: Fix out-of-bounds write in init_overlay_changeset()
If an overlay has no "__symbols__" node, but it has nodes without
"__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
filling in all fragments for nodes with "__overlay__" subnodes,
"fragment = &fragments[cnt]" will point beyond the end of the allocated
array.
Hence writing to "fragment->overlay" will overwrite unallocated memory,
which may lead to a crash later.
Fix this by deferring both the assignment to "fragment" and the
offending write afterwards until we know for sure the node has an
"__overlay__" subnode, and thus a valid entry in "fragments[]".
Fixes: 61b4de4e0b384f4a ("of: overlay: minor restructuring")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rob Herring <robh@kernel.org>
Diffstat (limited to 'Documentation')
0 files changed, 0 insertions, 0 deletions