Geert Uytterhoeven 35e691eddc of: overlay: Fix out-of-bounds write in init_overlay_changeset() ...

If an overlay has no "__symbols__" node, but it has nodes without
"__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
filling in all fragments for nodes with "__overlay__" subnodes,
"fragment = &fragments[cnt]" will point beyond the end of the allocated
array.

Hence writing to "fragment->overlay" will overwrite unallocated memory,
which may lead to a crash later.

Fix this by deferring both the assignment to "fragment" and the
offending write afterwards until we know for sure the node has an
"__overlay__" subnode, and thus a valid entry in "fragments[]".

Fixes: 61b4de4e0b ("of: overlay: minor restructuring")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rob Herring <robh@kernel.org>

2017-12-08 09:32:10 -06:00

..

accessibility

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

acpi

Merge tag 'acpi-fix-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2017-11-17 14:51:24 -08:00

amba

Merge tag 'dma-mapping-4.15' of git://git.infradead.org/users/hch/dma-mapping

2017-11-14 16:54:12 -08:00

android

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

ata

Merge branch 'for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata

2017-11-15 14:11:41 -08:00

atm

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

auxdisplay

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-13 17:56:58 -08:00

base

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

bcma

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-11-15 11:56:19 -08:00

block

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

bluetooth

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-11-04 09:26:51 +09:00

bus

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2017-11-16 16:05:01 -08:00

cdrom

Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block

2017-11-14 15:32:19 -08:00

char

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-26 14:11:54 -08:00

clk

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

2017-11-17 20:04:24 -08:00

clocksource

Merge tag 'for-linus-timers-conversion-final-v4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into timers/urgent

2017-11-23 16:29:05 +01:00

connector

drivers, connector: convert cn_callback_entry.refcnt from atomic_t to refcount_t

2017-10-22 02:22:39 +01:00

cpufreq

Merge tag 'pm-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2017-11-13 19:43:50 -08:00

cpuidle

Merge tag 'powerpc-4.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2017-11-16 12:47:46 -08:00

crypto

Merge tag 'powerpc-4.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2017-11-16 12:47:46 -08:00

dax

Merge tag 'libnvdimm-for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2017-11-17 09:51:57 -08:00

dca

…

devfreq

Merge branches 'pm-devfreq' and 'pm-tools'

2017-11-13 01:41:39 +01:00

dio

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dma

Merge tag 'dmaengine-4.15-rc1' of git://git.infradead.org/users/vkoul/slave-dma

2017-11-14 16:49:31 -08:00

dma-buf

Merge tag 'trace-v4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

2017-11-17 14:58:01 -08:00

edac

Merge tag 'modules-for-v4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux

2017-11-15 13:46:33 -08:00

eisa

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

extcon

Merge tag 'usb-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2017-11-13 21:14:07 -08:00

firewire

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-13 17:56:58 -08:00

firmware

drivers/firmware: psci: Convert timers to use timer_setup()

2017-11-21 15:46:44 -08:00

fmc

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fpga

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

fsi

…

gpio

Merge tag 'pinctrl-v4.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2017-11-16 10:57:11 -08:00

gpu

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

hid

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

hsi

Merge tag 'hsi-for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi

2017-11-15 13:35:43 -08:00

hv

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

hwmon

hwmon: (w83793) Remove duplicate NULL check

2017-11-16 01:03:19 -08:00

hwspinlock

Merge tag 'hwlock-v4.15' of git://github.com/andersson/remoteproc

2017-11-17 20:16:20 -08:00

hwtracing

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

i2c

Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-11-17 11:54:55 -08:00

ide

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide

2017-11-19 08:04:41 -10:00

idle

Merge branch 'pm-cpuidle'

2017-11-13 01:34:14 +01:00

iio

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

infiniband

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

input

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

iommu

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

ipack

…

irqchip

Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-26 14:39:20 -08:00

isdn

treewide: setup_timer() -> timer_setup() (2 field)

2017-11-21 15:57:09 -08:00

leds

Merge tag 'leds_for_4.15rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds

2017-11-14 18:09:31 -08:00

lightnvm

lightnvm: Convert timers to use timer_setup()

2017-11-21 15:46:44 -08:00

macintosh

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-13 17:56:58 -08:00

mailbox

Merge tag 'mailbox-v4.15' of git://git.linaro.org/landing-teams/working/fujitsu/integration

2017-11-15 13:39:18 -08:00

mcb

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

md

Merge branch 'for-linus' of git://git.kernel.dk/linux-block

2017-11-17 10:56:56 -08:00

media

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

memory

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2017-11-16 16:05:01 -08:00

memstick

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

message

Merge tag 'modules-for-v4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux

2017-11-15 13:46:33 -08:00

mfd

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

misc

lkdtm: include WARN format string

2017-11-17 16:10:01 -08:00

mmc

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

mtd

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

mux

…

net

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

nfc

treewide: setup_timer() -> timer_setup() (2 field)

2017-11-21 15:57:09 -08:00

ntb

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

nubus

Merge tag 'm68k-for-v4.15-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k

2017-11-13 12:10:24 -08:00

nvdimm

Merge tag 'libnvdimm-for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2017-11-17 09:51:57 -08:00

nvme

nvmet_fc: fix better length checking

2017-11-16 11:27:04 -07:00

nvmem

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

of

of: overlay: Fix out-of-bounds write in init_overlay_changeset()

2017-12-08 09:32:10 -06:00

opp

PM / OPP: Add dev_pm_opp_{un}register_get_pstate_helper()

2017-10-14 00:54:41 +02:00

oprofile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

parisc

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

parport

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

pci

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-26 14:11:54 -08:00

pcmcia

drivers/pcmcia/sa1111_badge4.c: avoid unused function warning

2017-11-17 16:10:04 -08:00

perf

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2017-11-15 10:56:56 -08:00

phy

Merge tag 'usb-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2017-11-13 21:14:07 -08:00

pinctrl

Merge tag 'pinctrl-v4.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2017-11-16 10:57:11 -08:00

platform

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

pnp

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

power

Merge tag 'for-v4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply

2017-11-15 13:37:15 -08:00

powercap

…

pps

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

ps3

…

ptp

Merge tag 'for-linus-4.15-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

2017-11-16 13:06:27 -08:00

pwm

Merge tag 'pwm/for-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm

2017-11-22 21:09:18 -10:00

rapidio

Merge branch 'akpm' (patches from Andrew)

2017-11-17 16:56:17 -08:00

ras

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-13 17:56:58 -08:00

regulator

Merge tag 'mfd-next-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

2017-11-16 09:15:57 -08:00

remoteproc

Merge tag 'rproc-v4.15' of git://github.com/andersson/remoteproc

2017-11-17 20:14:10 -08:00

reset

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2017-11-16 16:05:01 -08:00

rpmsg

Merge tag 'rpmsg-v4.15' of git://github.com/andersson/remoteproc

2017-11-17 20:12:08 -08:00

rtc

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

s390

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

sbus

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc

2017-11-17 20:21:44 -08:00

scsi

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

sfi

…

sh

Merge tag 'dma-mapping-4.15' of git://git.infradead.org/users/hch/dma-mapping

2017-11-14 16:54:12 -08:00

sn

…

soc

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2017-11-16 16:05:01 -08:00

spi

Merge remote-tracking branches 'spi/topic/sh-msiof', 'spi/topic/slave', 'spi/topic/spreadtrum' and 'spi/topic/tegra114' into spi-next

2017-11-10 21:33:51 +00:00

spmi

…

ssb

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

staging

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

target

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-11-25 08:37:16 -10:00

tc

…

tee

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

thermal

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux

2017-11-17 14:31:27 -08:00

thunderbolt

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

tty

treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts

2017-11-21 16:35:54 -08:00

uio

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

usb

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

uwb

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

vfio

Merge tag 'vfio-v4.15-rc1' of git://github.com/awilliam/linux-vfio

2017-11-14 16:47:47 -08:00

vhost

Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-11-17 12:08:18 -08:00

video

Merge tag 'fbdev-v4.15' of git://github.com/bzolnier/linux

2017-11-20 21:50:24 -10:00

virt

…

virtio

virtio_balloon: fix deadlock on OOM

2017-11-14 23:57:38 +02:00

vlynq

…

vme

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

w1

Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2017-11-16 09:10:59 -08:00

watchdog

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

xen

treewide: Switch DEFINE_TIMER callbacks to struct timer_list *

2017-11-21 15:57:05 -08:00

zorro

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

Merge branches 'pm-cpufreq-sched' and 'pm-opp'

2017-11-13 01:40:52 +01:00

Makefile

Merge branches 'pm-cpufreq-sched' and 'pm-opp'

2017-11-13 01:40:52 +01:00