Re: [PATCH 3/6] xen/dt-overlay: check overlay size before memcmp in tracker lookup

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Wed, 15 Apr 2026, Luca Fancellu wrote:
> Hi Michal,
> 
> > On 15 Apr 2026, at 12:36, Michal Orzel <michal.orzel@xxxxxxx> wrote:
> > 
> > find_track_entry_from_tracker() compares overlay_fdt_size bytes of the
> > stored overlay against the input without verifying that the stored
> > overlay is at least that large. If the input is larger, memcmp reads
> > past the stored allocation. If smaller, a prefix match could falsely
> > succeed.
> > 
> > Compare fdt_totalsize() of the stored overlay against overlay_fdt_size
> > first. Both values are validated by check_overlay_fdt() at their
> > respective entry points, so no additional field in overlay_track is
> > needed.
> > 
> > Fixes: 7e5c4a8b86f1 ("xen/arm: Implement device tree node removal 
> > functionalities")
> > Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>
> > ---
> 
> Reviewed-by: Luca Fancellu <luca.fancellu@xxxxxxx>

Acked-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>