[PATCH 0/2] of: reserved_mem: fix stack overflow and make dynamic reserved region configurable

[PATCH 0/2] of: reserved_mem: fix stack overflow and make dynamic reserved region configurable

[Wandun Chen]

From: Wandun Chen <chenwandun@lixiang.com>

Patch 1 fixes a stack buffer overflow in fdt_scan_reserved_mem() when the
DTS contains more than 64 reserved-memory regions.

Patch 2 makes the limit configurable via Kconfig
(OF_RESERVED_MEM_DYNAMIC_REGIONS) so platforms with many such regions
can modify it without patching the source.

Wandun Chen (2):
  of: reserved_mem: avoid stack buffer overflow in
    fdt_scan_reserved_mem()
  of: reserved_mem: add config to extend dynamic reserved memory regions

 drivers/of/Kconfig           | 11 +++++++++++
 drivers/of/of_private.h      |  2 +-
 drivers/of/of_reserved_mem.c |  6 ++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH 1/2] of: reserved_mem: avoid stack buffer overflow in fdt_scan_reserved_mem()

[Wandun Chen]

From: Wandun Chen <chenwandun@lixiang.com>

Sashiko found a potential stack buffer overflow in fdt_scan_reserved_mem()
due to missing bounds checking on dynamic_nodes_cnt [1].

Fix this by adding bounds check.

Link: https://sashiko.dev/#/patchset/20260604015332.3669384-1-chenwandun1%40gmail.com?part=1 [1]
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
---
 drivers/of/of_reserved_mem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index ce1d5530ec0f..27dc98aa9bf9 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -346,6 +346,12 @@ int __init fdt_scan_reserved_mem(void)
 		err = __reserved_mem_reserve_reg(child, uname);
 		if (!err)
 			count++;
+
+		if (dynamic_nodes_cnt >= MAX_RESERVED_REGIONS) {
+			pr_err_once("Reserved memory: reached MAX_RESERVED_REGIONS(%d)\n",
+				    MAX_RESERVED_REGIONS);
+			continue;
+		}
 		/*
 		 * Save the nodes for the dynamically-placed regions
 		 * into an array which will be used for allocation right
-- 
2.43.0

[PATCH 2/2] of: reserved_mem: add config to extend dynamic reserved memory regions

[Wandun Chen]

From: Wandun Chen <chenwandun@lixiang.com>

Nowadays, the dynamic reserved memory regions is 64 by default, If
the count of reserved memory regions defined in DTS bigger than 64,
only 64 reserved memory can be handled properly.

So add a config to configure the actual dynamic reserved memory
regions count instead of modify the code.

Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
---
 drivers/of/Kconfig           | 11 +++++++++++
 drivers/of/of_private.h      |  2 +-
 drivers/of/of_reserved_mem.c |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 50697cc3b07e..d6496ec3765c 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -99,6 +99,17 @@ config OF_IRQ
 config OF_RESERVED_MEM
 	def_bool OF_EARLY_FLATTREE
 
+config OF_RESERVED_MEM_DYNAMIC_REGIONS
+	int "Maximum count of the dynamic reserved memory regions"
+	depends on OF_RESERVED_MEM
+	default 64
+	range 1 256
+	help
+	  Allows to define proper dynamic reserved memory regions number
+	  according to DTS configuration.
+
+	  If unsure, leave the default value "64".
+
 config OF_RESOLVE
 	bool
 
diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
index 0ae16da066e2..6ad00798f39d 100644
--- a/drivers/of/of_private.h
+++ b/drivers/of/of_private.h
@@ -9,7 +9,7 @@
  */
 
 #define FDT_ALIGN_SIZE 8
-#define MAX_RESERVED_REGIONS    64
+#define MAX_RESERVED_REGIONS	CONFIG_OF_RESERVED_MEM_DYNAMIC_REGIONS
 
 /**
  * struct alias_prop - Alias property in 'aliases' node
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 27dc98aa9bf9..d1680fc4fb38 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -348,7 +348,7 @@ int __init fdt_scan_reserved_mem(void)
 			count++;
 
 		if (dynamic_nodes_cnt >= MAX_RESERVED_REGIONS) {
-			pr_err_once("Reserved memory: reached MAX_RESERVED_REGIONS(%d)\n",
+			pr_err_once("Reserved memory: reached MAX_RESERVED_REGIONS(%d), try expanding CONFIG_OF_RESERVED_MEM_DYNAMIC_REGIONS.\n",
 				    MAX_RESERVED_REGIONS);
 			continue;
 		}
-- 
2.43.0

Re: [PATCH 2/2] of: reserved_mem: add config to extend dynamic reserved memory regions

[Rob Herring]

On Thu, Jun 04, 2026 at 03:36:11PM +0800, Wandun Chen wrote:
> From: Wandun Chen <chenwandun@lixiang.com>
> 
> Nowadays, the dynamic reserved memory regions is 64 by default, If
> the count of reserved memory regions defined in DTS bigger than 64,
> only 64 reserved memory can be handled properly.
> 
> So add a config to configure the actual dynamic reserved memory
> regions count instead of modify the code.
> 
> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
> ---
>  drivers/of/Kconfig           | 11 +++++++++++
>  drivers/of/of_private.h      |  2 +-
>  drivers/of/of_reserved_mem.c |  2 +-
>  3 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
> index 50697cc3b07e..d6496ec3765c 100644
> --- a/drivers/of/Kconfig
> +++ b/drivers/of/Kconfig
> @@ -99,6 +99,17 @@ config OF_IRQ
>  config OF_RESERVED_MEM
>  	def_bool OF_EARLY_FLATTREE
>  
> +config OF_RESERVED_MEM_DYNAMIC_REGIONS
> +	int "Maximum count of the dynamic reserved memory regions"
> +	depends on OF_RESERVED_MEM
> +	default 64
> +	range 1 256

My opinion on making this a config option is well documented. That's the 
primary reason we split dynamic regions.

How many do you need and why do you need so many regions? Seems like an 
abuse of reserved memory. 

Rob

Re: [PATCH 2/2] of: reserved_mem: add config to extend dynamic reserved memory regions

[Wandun]

On 6/5/26 03:33, Rob Herring wrote:
> On Thu, Jun 04, 2026 at 03:36:11PM +0800, Wandun Chen wrote:
>> From: Wandun Chen <chenwandun@lixiang.com>
>>
>> Nowadays, the dynamic reserved memory regions is 64 by default, If
>> the count of reserved memory regions defined in DTS bigger than 64,
>> only 64 reserved memory can be handled properly.
>>
>> So add a config to configure the actual dynamic reserved memory
>> regions count instead of modify the code.
>>
>> Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
>> ---
>>   drivers/of/Kconfig           | 11 +++++++++++
>>   drivers/of/of_private.h      |  2 +-
>>   drivers/of/of_reserved_mem.c |  2 +-
>>   3 files changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
>> index 50697cc3b07e..d6496ec3765c 100644
>> --- a/drivers/of/Kconfig
>> +++ b/drivers/of/Kconfig
>> @@ -99,6 +99,17 @@ config OF_IRQ
>>   config OF_RESERVED_MEM
>>   	def_bool OF_EARLY_FLATTREE
>>   
>> +config OF_RESERVED_MEM_DYNAMIC_REGIONS
>> +	int "Maximum count of the dynamic reserved memory regions"
>> +	depends on OF_RESERVED_MEM
>> +	default 64
>> +	range 1 256
> My opinion on making this a config option is well documented. That's the
> primary reason we split dynamic regions.
Get it.
>
> How many do you need and why do you need so many regions? Seems like an
> abuse of reserved memory.
I also agree that 64 dynamic regions should be sufficient for reasonable 
use cases.
To give some context on why I wrote this patch: the 64 dynamic region 
limit is implicit, there is no message to inform the user, but more than 
64 regions also seems like an abuse of reserved memory. I will drop this 
patch as well, thanks for the review. Best regards, Wandun
>
> Rob