Commit 48d499bd authored by Frank Rowand's avatar Frank Rowand Committed by Rob Herring
Browse files

of: unittest: overlay: ensure proper alignment of copied FDT 

The Devicetree standard specifies an 8 byte alignment of the FDT.
Code in libfdt expects this alignment for an FDT image in memory.
kmemdup() returns 4 byte alignment on openrisc.  Replace kmemdup()
with kmalloc(), align pointer, memcpy() to get proper alignment.

The 4 byte alignment exposed a related bug which triggered a crash
on openrisc with:
commit 79edff12 ("scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9")
as reported in:
https://lore.kernel.org/lkml/20210327224116.69309-1-linux@roeck-us.net/



Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarFrank Rowand <frank.rowand@sony.com>
Link: https://lore.kernel.org/r/20210408204508.2276230-1-frowand.list@gmail.com


Signed-off-by: default avatarRob Herring <robh@kernel.org>
parent 649cab56

drivers/of/of_private.h

+2 −0
Original line number Diff line number Diff line
@@ -8,6 +8,8 @@ 
 * Copyright (C) 1996-2005 Paul Mackerras.

 */



#define FDT_ALIGN_SIZE 8



/**

 * struct alias_prop - Alias property in 'aliases' node

 * @link:	List node to link the structure in aliases_lookup list

drivers/of/overlay.c

+14 −8
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ struct fragment { 
 * struct overlay_changeset

 * @id:			changeset identifier

 * @ovcs_list:		list on which we are located

 * @fdt:		FDT that was unflattened to create @overlay_tree

 * @fdt:		base of memory allocated to hold aligned FDT that was unflattened to create @overlay_tree

 * @overlay_tree:	expanded device tree that contains the fragment nodes

 * @count:		count of fragment structures

 * @fragments:		fragment nodes in the overlay expanded device tree
@@ -719,8 +719,8 @@ static struct device_node *find_target(struct device_node *info_node) 
/**

 * init_overlay_changeset() - initialize overlay changeset from overlay tree

 * @ovcs:	Overlay changeset to build

 * @fdt:	the FDT that was unflattened to create @tree

 * @tree:	Contains all the overlay fragments and overlay fixup nodes

 * @fdt:	base of memory allocated to hold aligned FDT that was unflattened to create @tree

 * @tree:	Contains the overlay fragments and overlay fixup nodes

 *

 * Initialize @ovcs.  Populate @ovcs->fragments with node information from

 * the top level of @tree.  The relevant top level nodes are the fragment
@@ -873,7 +873,7 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs) 
 * internal documentation

 *

 * of_overlay_apply() - Create and apply an overlay changeset

 * @fdt:	the FDT that was unflattened to create @tree

 * @fdt:	base of memory allocated to hold the aligned FDT

 * @tree:	Expanded overlay device tree

 * @ovcs_id:	Pointer to overlay changeset id

 *
@@ -953,7 +953,9 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree, 
	/*

	 * after overlay_notify(), ovcs->overlay_tree related pointers may have

	 * leaked to drivers, so can not kfree() tree, aka ovcs->overlay_tree;

	 * and can not free fdt, aka ovcs->fdt

	 * and can not free memory containing aligned fdt.  The aligned fdt

	 * is contained within the memory at ovcs->fdt, possibly at an offset

	 * from ovcs->fdt.

	 */

	ret = overlay_notify(ovcs, OF_OVERLAY_PRE_APPLY);

	if (ret) {
@@ -1014,7 +1016,8 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree, 
int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size,

			 int *ovcs_id)

{

	const void *new_fdt;

	void *new_fdt;

	void *new_fdt_align;

	int ret;

	u32 size;

	struct device_node *overlay_root = NULL;
@@ -1036,11 +1039,14 @@ int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size, 
	 * Must create permanent copy of FDT because of_fdt_unflatten_tree()

	 * will create pointers to the passed in FDT in the unflattened tree.

	 */

	new_fdt = kmemdup(overlay_fdt, size, GFP_KERNEL);

	new_fdt = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);

	if (!new_fdt)

		return -ENOMEM;



	of_fdt_unflatten_tree(new_fdt, NULL, &overlay_root);

	new_fdt_align = PTR_ALIGN(new_fdt, FDT_ALIGN_SIZE);

	memcpy(new_fdt_align, overlay_fdt, size);



	of_fdt_unflatten_tree(new_fdt_align, NULL, &overlay_root);

	if (!overlay_root) {

		pr_err("unable to unflatten overlay_fdt\n");

		ret = -EINVAL;

drivers/of/unittest.c

+7 −2
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/slab.h>

#include <linux/device.h>

#include <linux/platform_device.h>

#include <linux/kernel.h>



#include <linux/i2c.h>

#include <linux/i2c-mux.h>
@@ -1408,6 +1409,7 @@ static void attach_node_and_children(struct device_node *np) 
static int __init unittest_data_add(void)

{

	void *unittest_data;

	void *unittest_data_align;

	struct device_node *unittest_data_node = NULL, *np;

	/*

	 * __dtb_testcases_begin[] and __dtb_testcases_end[] are magically
@@ -1425,11 +1427,14 @@ static int __init unittest_data_add(void) 
	}



	/* creating copy */

	unittest_data = kmemdup(__dtb_testcases_begin, size, GFP_KERNEL);

	unittest_data = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);

	if (!unittest_data)

		return -ENOMEM;



	ret = of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node);

	unittest_data_align = PTR_ALIGN(unittest_data, FDT_ALIGN_SIZE);

	memcpy(unittest_data_align, __dtb_testcases_begin, size);



	ret = of_fdt_unflatten_tree(unittest_data_align, NULL, &unittest_data_node);

	if (!ret) {

		pr_warn("%s: unflatten testcases tree failed\n", __func__);

		kfree(unittest_data);