Received-SPF: Pass (protection.outlook.com: domain of xilinx.com designates
 149.199.62.198 as permitted sender) receiver=protection.outlook.com;
 client-ip=149.199.62.198; helo=xsj-pvapexch01.xlnx.xilinx.com;
Envelope-to: dwmw2@infradead.org,
 mdf@kernel.org,
 trix@redhat.com,
 devicetree@vger.kernel.org,
 linux-fpga@vger.kernel.org,
 linux-kernel@vger.kernel.org,
 robh@kernel.org
Subject: Re: [PATCH V2 XRT Alveo Infrastructure 3/9] of: handle fdt buffer
 alignment inside unflatten function
To:     Rob Herring <robh@kernel.org>, Lizhi Hou <lizhi.hou@xilinx.com>
CC:     <linux-kernel@vger.kernel.org>, <linux-fpga@vger.kernel.org>,
        <maxz@xilinx.com>, <sonal.santan@xilinx.com>, <yliu@xilinx.com>,
        <michal.simek@xilinx.com>, <stefanos@xilinx.com>,
        <devicetree@vger.kernel.org>, <trix@redhat.com>, <mdf@kernel.org>,
        <dwmw2@infradead.org>, Max Zhen <max.zhen@xilinx.com>
References: <20211119222412.1092763-1-lizhi.hou@xilinx.com>
 <20211119222412.1092763-4-lizhi.hou@xilinx.com>
 <YaWE/2ikgpXi2hzY@robh.at.kernel.org>
From:   Lizhi Hou <lizhi.hou@xilinx.com>
Message-ID: <e76c91d8-f2a2-f11b-14cb-da554bf42793@xilinx.com>
Date:   Tue, 30 Nov 2021 13:13:46 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.9.1
MIME-Version: 1.0
In-Reply-To: <YaWE/2ikgpXi2hzY@robh.at.kernel.org>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Nov 2021 21:15:22.9825
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 757014e0-438d-477d-3338-08d9b4468591
X-MS-Exchange-CrossTenant-Id: 657af505-d5df-48d0-8300-c31994686c5c
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=657af505-d5df-48d0-8300-c31994686c5c;Ip=[149.199.62.198];Helo=[xsj-pvapexch01.xlnx.xilinx.com]
X-MS-Exchange-CrossTenant-AuthSource: BN1NAM02FT049.eop-nam02.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR02MB7420
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 11/29/21 5:57 PM, Rob Herring wrote:
> On Fri, Nov 19, 2021 at 02:24:06PM -0800, Lizhi Hou wrote:
>> Add alignment check to of_fdt_unflatten_tree(). If it is not aligned,
>> allocate a aligned buffer and copy the fdt blob. So the caller does not
>> have to deal with the buffer alignment before calling this function.
>> XRT uses this function to unflatten fdt which is from Alveo firmware.
>>
>> Signed-off-by: Sonal Santan <sonal.santan@xilinx.com>
>> Signed-off-by: Max Zhen <max.zhen@xilinx.com>
>> Signed-off-by: Lizhi Hou <lizhi.hou@xilinx.com>
>> ---
>>   drivers/of/fdt.c | 17 ++++++++++++++++-
>>   1 file changed, 16 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
>> index 4546572af24b..d64445e43ceb 100644
>> --- a/drivers/of/fdt.c
>> +++ b/drivers/of/fdt.c
>> @@ -455,13 +455,28 @@ void *of_fdt_unflatten_tree(const unsigned long *blob,
>>                            struct device_node *dad,
>>                            struct device_node **mynodes)
>>   {
>> +     void *new_fdt = NULL, *fdt_align;
>>        void *mem;
>>
>> +     if (fdt_check_header(blob)) {
>> +             pr_err("Invalid fdt blob\n");
>> +             return NULL;
>> +     }
>> +     fdt_align = (void *)PTR_ALIGN(blob, FDT_ALIGN_SIZE);
>> +     if (fdt_align != blob) {
>> +             new_fdt = kmalloc(fdt_totalsize(blob) + FDT_ALIGN_SIZE, GFP_KERNEL);
>> +             if (!new_fdt)
>> +                     return NULL;
>> +             fdt_align = PTR_ALIGN(new_fdt, FDT_ALIGN_SIZE);
> Where's the copy?
>
>> +     }
>> +
>>        mutex_lock(&of_fdt_unflatten_mutex);
>> -     mem = __unflatten_device_tree(blob, dad, mynodes, &kernel_tree_alloc,
>> +     mem = __unflatten_device_tree(fdt_align, dad, mynodes, &kernel_tree_alloc,
>>                                      true);
>>        mutex_unlock(&of_fdt_unflatten_mutex);
>>
>> +     kfree(new_fdt);
> You know the unflattened DT just references strings and property values
> from the flattened DT. So you just caused a use after free.
>
> Fix your firmware to align the DT.

Thanks a lot for pointing this out. I did not aware the direct reference 
of strings and values from the flattened DT. And I will fix this.


Lizhi

>
> Rob