Wandun Chen e1686ca81d of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails ...

The global pointer 'reserved_mem' continues to reference the
reserved_mem_array which lives in __initdata if
alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is
exported for post-init use, that would dereference freed memory
and trigger a use-after-free.

So reset reserved_mem_count to 0 when alloc_reserved_mem_array()
fails.

Fixes: 00c9a452a2 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array")
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

2026-06-04 14:41:22 -05:00

..

unittest-data

of: unittest: Add a test case for for_each_of_imap_item iterator

2026-01-15 12:03:27 +01:00

.kunitconfig

of: Allow overlay kunit tests to run CONFIG_OF_OVERLAY=n

2024-11-15 14:03:28 -06:00

address.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

base.c

drivers/of: validate live-tree string properties before string use

2026-05-13 17:18:01 -05:00

cpu.c

of: Constify struct device_node function arguments

2024-10-15 08:58:36 -05:00

device.c

of: Clarify OF device context in of_match_device() comment

2025-07-30 17:49:06 -05:00

dynamic.c

drivers/of: validate status properties in reconfig state changes

2026-05-13 17:19:08 -05:00

empty_root.dts

of: Add #address-cells/#size-cells in the device-tree root empty node

2024-12-02 09:26:33 -06:00

fdt_address.c

of: Remove a duplicated code block

2025-01-13 08:39:28 -06:00

fdt.c

drivers/of: fdt: Make ibm,phandle logic only happen on pseries

2026-06-03 21:01:40 -05:00

irq.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

Merge tag 'kbuild-v6.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

2024-11-30 13:41:50 -08:00

kexec.c

Merge tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock

2026-04-18 11:29:14 -07:00

kobj.c

sysfs: treewide: switch back to bin_attribute::read()/write()

2025-06-17 10:44:13 +02:00

kunit_overlay_test.dtso

of: Add a KUnit test for overlays and test managed APIs

2024-07-29 15:33:12 -07:00

Makefile

of: Add a KUnit test for overlays and test managed APIs

2024-07-29 15:33:12 -07:00

module.c

of: module: remove strlen() call in of_modalias()

2024-10-16 12:00:10 -05:00

of_kunit_helpers.c

of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node

2025-11-26 19:46:23 -06:00

of_numa.c

of_numa: fix uninitialized memory nodes causing kernel panic

2025-08-27 22:45:41 -07:00

of_private.h

of: reserved_mem: clarify fdt_scan_reserved_mem*() functions

2026-03-26 14:12:02 -05:00

of_reserved_mem.c

of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails

2026-06-04 14:41:22 -05:00

of_test.c

of: address: Add kunit test for __of_address_resource_bounds()

2025-02-02 20:59:04 -06:00

overlay_test.c

of: Allow overlay kunit tests to run CONFIG_OF_OVERLAY=n

2024-11-15 14:03:28 -06:00

overlay.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pdt.c

of: Do not expose of_alias_scan() and correct its comments

2025-01-17 08:52:57 -06:00

platform.c

Merge tag 'devicetree-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-04-17 14:09:02 -07:00

property.c

drivers/of: validate live-tree string properties before string use

2026-05-13 17:18:01 -05:00

resolver.c

of: Introduce and apply private is_pseudo_property()

2025-02-25 08:43:00 -06:00

unittest.c

drivers/of: validate live-tree string properties before string use

2026-05-13 17:18:01 -05:00