From a7b7a50b33da3e38a2bea6120fcbf119945751b8 Mon Sep 17 00:00:00 2001 From: Michal Orzel Date: Wed, 15 Apr 2026 13:36:57 +0200 Subject: [PATCH] xen/dt-overlay: check overlay size before memcmp in tracker lookup find_track_entry_from_tracker() compares overlay_fdt_size bytes of the stored overlay against the input without verifying that the stored overlay is at least that large. If the input is larger, memcmp reads past the stored allocation. If smaller, a prefix match could falsely succeed. Compare fdt_totalsize() of the stored overlay against overlay_fdt_size first. Both values are validated by check_overlay_fdt() at their respective entry points, so no additional field in overlay_track is needed. Fixes: 7e5c4a8b86f1 ("xen/arm: Implement device tree node removal functionalities") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini --- xen/common/device-tree/dt-overlay.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dt-overlay.c b/xen/common/device-tree/dt-overlay.c index 3853e6e347..0eed1532a1 100644 --- a/xen/common/device-tree/dt-overlay.c +++ b/xen/common/device-tree/dt-overlay.c @@ -379,7 +379,8 @@ find_track_entry_from_tracker(const void *overlay_fdt, */ list_for_each_entry_safe( entry, temp, &overlay_tracker, entry ) { - if ( memcmp(entry->overlay_fdt, overlay_fdt, overlay_fdt_size) == 0 ) + if ( (fdt_totalsize(entry->overlay_fdt) == overlay_fdt_size) && + !memcmp(entry->overlay_fdt, overlay_fdt, overlay_fdt_size) ) { found_entry = true; break;