In reboot_mode_register() we iterate over the properties of the given node in order to count the valid properties. The count is then used to allocate arrays which are then filled in another iteration loop over the properties. In that loop we use the array entries before we actually realize that the property is invalid and shall be skipped. That means we access an out of bounds array entry when the very last property in the node is invalid. In my case this blew up when enabling CONFIG_OF_OVERLAY_LIVE which results in an additional phandle = <xy> property in the node. Fix this by simply allocating one array entry more than finally needed. Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> --- drivers/power/reset/reboot-mode.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/power/reset/reboot-mode.c b/drivers/power/reset/reboot-mode.c index 375ef0adcb..7f940a2d88 100644 --- a/drivers/power/reset/reboot-mode.c +++ b/drivers/power/reset/reboot-mode.c @@ -139,8 +139,13 @@ int reboot_mode_register(struct reboot_mode_driver *reboot, reboot->nmodes = nmodes; reboot->nelems = nelems; - reboot->magics = xzalloc(nmodes * nelems * sizeof(u32)); - reboot->modes = xzalloc(nmodes * sizeof(const char *)); + + /* + * Allocate one entry more than necessary, because in the loop below + * we use an entry before we realize that the property is not valid. + */ + reboot->magics = xzalloc((nmodes + 1) * nelems * sizeof(u32)); + reboot->modes = xzalloc((nmodes + 1) * sizeof(const char *)); reboot_mode_print(reboot, "registering magic", reboot_mode); -- 2.30.2
