Re: [PATCH V2 XRT Alveo Infrastructure 3/9] of: handle fdt buffer alignment inside unflatten function

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 11/29/21 5:57 PM, Rob Herring wrote:
On Fri, Nov 19, 2021 at 02:24:06PM -0800, Lizhi Hou wrote:
Add alignment check to of_fdt_unflatten_tree(). If it is not aligned,
allocate a aligned buffer and copy the fdt blob. So the caller does not
have to deal with the buffer alignment before calling this function.
XRT uses this function to unflatten fdt which is from Alveo firmware.

Signed-off-by: Sonal Santan <sonal.santan@xxxxxxxxxx>
Signed-off-by: Max Zhen <max.zhen@xxxxxxxxxx>
Signed-off-by: Lizhi Hou <lizhi.hou@xxxxxxxxxx>
---
  drivers/of/fdt.c | 17 ++++++++++++++++-
  1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 4546572af24b..d64445e43ceb 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -455,13 +455,28 @@ void *of_fdt_unflatten_tree(const unsigned long *blob,
                           struct device_node *dad,
                           struct device_node **mynodes)
  {
+     void *new_fdt = NULL, *fdt_align;
       void *mem;

+     if (fdt_check_header(blob)) {
+             pr_err("Invalid fdt blob\n");
+             return NULL;
+     }
+     fdt_align = (void *)PTR_ALIGN(blob, FDT_ALIGN_SIZE);
+     if (fdt_align != blob) {
+             new_fdt = kmalloc(fdt_totalsize(blob) + FDT_ALIGN_SIZE, GFP_KERNEL);
+             if (!new_fdt)
+                     return NULL;
+             fdt_align = PTR_ALIGN(new_fdt, FDT_ALIGN_SIZE);
Where's the copy?

+     }
+
       mutex_lock(&of_fdt_unflatten_mutex);
-     mem = __unflatten_device_tree(blob, dad, mynodes, &kernel_tree_alloc,
+     mem = __unflatten_device_tree(fdt_align, dad, mynodes, &kernel_tree_alloc,
                                     true);
       mutex_unlock(&of_fdt_unflatten_mutex);

+     kfree(new_fdt);
You know the unflattened DT just references strings and property values
from the flattened DT. So you just caused a use after free.

Fix your firmware to align the DT.

Thanks a lot for pointing this out. I did not aware the direct reference of strings and values from the flattened DT. And I will fix this.


Lizhi


Rob



[Index of Archives]     [Device Tree Compilter]     [Device Tree Spec]     [Linux Driver Backports]     [Video for Linux]     [Linux USB Devel]     [Linux PCI Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Yosemite Backpacking]


  Powered by Linux