From ca3f5e85aa4ed8273537b31820e97b94efd667ef Mon Sep 17 00:00:00 2001 From: Michal Orzel Date: Wed, 15 Apr 2026 13:36:56 +0200 Subject: [PATCH] xen/dt-overlay: fix rangeset leak and dead code in domctl path handle_attach_overlay_nodes() unconditionally creates new rangesets without checking whether they already exist from a prior attach. A repeated attach for the same overlay leaks the original pair. Reject the operation with -EEXIST if rangesets are already present. Also, dt_overlay_domctl() early-returns -EOPNOTSUPP for any operation other than ATTACH, making the if/else at the bottom unreachable. Remove the dead branch. Fixes: 4c733873b5c2 ("xen/arm: Add XEN_DOMCTL_dt_overlay and device attachment to domains") Reported-by: Jan Beulich Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini --- xen/common/device-tree/dt-overlay.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/xen/common/device-tree/dt-overlay.c b/xen/common/device-tree/dt-overlay.c index 6fa07dbf42..3853e6e347 100644 --- a/xen/common/device-tree/dt-overlay.c +++ b/xen/common/device-tree/dt-overlay.c @@ -861,6 +861,13 @@ static long handle_attach_overlay_nodes(struct domain *d, goto out; } + if ( entry->irq_ranges || entry->iomem_ranges ) + { + printk(XENLOG_ERR "Overlay is already attached\n"); + spin_unlock(&overlay_lock); + return -EEXIST; + } + entry->irq_ranges = rangeset_new(d, "Overlays: Interrupts", 0); if (entry->irq_ranges == NULL) { @@ -991,10 +998,7 @@ long dt_overlay_domctl(struct domain *d, struct xen_domctl_dt_overlay *op) return -EFAULT; } - if ( op->overlay_op == XEN_DOMCTL_DT_OVERLAY_ATTACH ) - ret = handle_attach_overlay_nodes(d, overlay_fdt, op->overlay_fdt_size); - else - ret = -EOPNOTSUPP; + ret = handle_attach_overlay_nodes(d, overlay_fdt, op->overlay_fdt_size); xfree(overlay_fdt);