Geert Uytterhoeven 35e691eddc of: overlay: Fix out-of-bounds write in init_overlay_changeset() ...

If an overlay has no "__symbols__" node, but it has nodes without
"__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
filling in all fragments for nodes with "__overlay__" subnodes,
"fragment = &fragments[cnt]" will point beyond the end of the allocated
array.

Hence writing to "fragment->overlay" will overwrite unallocated memory,
which may lead to a crash later.

Fix this by deferring both the assignment to "fragment" and the
offending write afterwards until we know for sure the node has an
"__overlay__" subnode, and thus a valid entry in "fragments[]".

Fixes: 61b4de4e0b384f4a ("of: overlay: minor restructuring")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rob Herring <robh@kernel.org>

2017-12-08 09:32:10 -06:00

..

unittest-data

DeviceTree fixes for 4.15:

2017-11-20 21:38:41 -10:00

address.c

of/pci: Add of_pci_dma_range_parser_init() for dma-ranges parsing support

2017-10-05 15:52:34 -05:00

base.c

DeviceTree fixes for 4.15:

2017-11-20 21:38:41 -10:00

device.c

drivers: flag buses which demand DMA configuration

2017-10-19 16:34:52 +02:00

dynamic.c

of: Spelling s/changset/changeset/

2017-12-06 14:56:32 -06:00

fdt_address.c

…

fdt.c

of/fdt: Document detached argument to __unflatten_device_tree()

2017-10-16 16:49:18 -05:00

irq.c

DeviceTree updates for 4.14:

2017-09-07 14:43:33 -07:00

Kconfig

of: make kobject and bin_attribute support configurable

2017-10-16 13:37:38 -05:00

kobj.c

of: make kobject and bin_attribute support configurable

2017-10-16 13:37:38 -05:00

Makefile

DeviceTree for 4.15:

2017-11-14 18:25:40 -08:00

of_mdio.c

of_mdio: Fix broken PHY IRQ in case of probe deferral

2017-10-22 03:20:25 +01:00

of_net.c

…

of_numa.c

…

of_pci_irq.c

OF/PCI: Update of_irq_parse_and_map_pci() comment

2017-07-02 16:14:28 -05:00

of_pci.c

of/pci: Fix theoretical NULL dereference

2017-11-16 11:01:14 -06:00

of_private.h

of: overlay: remove a dependency on device node full_name

2017-10-17 20:47:37 -05:00

of_reserved_mem.c

ARM: SoC driver updates for v4.15

2017-11-16 16:05:01 -08:00

overlay.c

of: overlay: Fix out-of-bounds write in init_overlay_changeset()

2017-12-08 09:32:10 -06:00

pdt.c

…

platform.c

soc: qcom: Remote filesystem memory driver

2017-10-22 05:06:34 -05:00

property.c

device property: Make fwnode_handle_get() return the fwnode

2017-11-09 00:17:22 +01:00

resolver.c

of: overlay: avoid race condition between applying multiple overlays

2017-10-17 20:47:27 -05:00

unittest.c

of: unittest: Remove bogus overlay mutex release from overlay_data_add()

2017-12-06 14:56:32 -06:00