Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

of: fdt: fix off-by-one error in unflatten_dt_nodes()

Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
forgot to fix up the depth check in the loop body in unflatten_dt_nodes()
which makes it possible to overflow the nps[] buffer...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru

authored by

Sergey Shtylyov and committed by
Rob Herring
2f945a79 568035b0

+1 -1
+1 -1
drivers/of/fdt.c
··· 314 314 for (offset = 0; 315 315 offset >= 0 && depth >= initial_depth; 316 316 offset = fdt_next_node(blob, offset, &depth)) { 317 - if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH)) 317 + if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1)) 318 318 continue; 319 319 320 320 if (!IS_ENABLED(CONFIG_OF_KOBJ) &&