From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751109AbdLIGBr (ORCPT ); Sat, 9 Dec 2017 01:01:47 -0500 Received: from mail-pg0-f67.google.com ([74.125.83.67]:44042 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750817AbdLIGBp (ORCPT ); Sat, 9 Dec 2017 01:01:45 -0500 X-Google-Smtp-Source: AGs4zMb0bfeMPahxcpZYbM6iLNQkWnkoXj6YWgliz9GV3arknedSREUVaINfsffN/GAphypxgVVWMQ== Subject: Re: [PATCH 0/2] of: overlay: Crash fix and improvement To: Geert Uytterhoeven , Pantelis Antoniou , Rob Herring Cc: devicetree@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org References: <1512738783-17452-1-git-send-email-geert+renesas@glider.be> From: Frank Rowand Message-ID: Date: Fri, 8 Dec 2017 22:01:42 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <1512738783-17452-1-git-send-email-geert+renesas@glider.be> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/08/17 05:13, Geert Uytterhoeven wrote: > Hi Pantelis, Rob, Frank, > > This patch series fixes memory corruption when applying overlays. > > I first noticed this when using OF configfs. After lots of failed > debugging attempts, I bisected it to "of: overlay: add per overlay sysfs > attributes", which is not upstream. But that was a red herring: that > commit enlarged struct fragment to exactly 64-bytes, which just made it > more likely to cause random corruption when writing beyond the end of an > array of fragment structures. With the smaller structure size before, > such writes usually ended up in the unused holes between allocated > blocks, causing no harm. > > The first patch is the real fix, and applies to both v4.15-rc2 and Rob's > for-next branch. > The second patch is a small improvement, and applies to Rob's for-next > branch only. Overlay FDT files should not have invalid contents. But they inevitably will, so the code has to handle those cases. Thanks for finding this problem and making the code better! For the full series: Reviewed-by: Frank Rowand > I've updated my topic/overlays and topic/renesas-overlays branches at > git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers.git > accordingly. > > Thanks! > > Geert Uytterhoeven (2): > of: overlay: Fix out-of-bounds write in init_overlay_changeset() > of: overlay: Make node skipping in init_overlay_changeset() clearer > > drivers/of/overlay.c | 22 ++++++++++++---------- > 1 file changed, 12 insertions(+), 10 deletions(-) >