[PATCH 1/2] powerpc/kaslr_booke: Fix reserved region overlap checks

[Thorsten Blum]

FDT reserved region addresses can be 64-bit, but regions_overlap() takes
32-bit arguments, which could truncate values before comparing them and
cause KASLR to incorrectly detect or miss overlaps. Make
regions_overlap() work with 64-bit values instead.

Also clamp reservation sizes before computing their end addresses to
prevent the addition from overflowing.

Fixes: 6a38ea1d7b94 ("powerpc/fsl_booke/32: randomize the kernel image offset")
Cc: sta...@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.b...@linux.dev>
---
 arch/powerpc/mm/nohash/kaslr_booke.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c 
b/arch/powerpc/mm/nohash/kaslr_booke.c
index 5e4897daaaea..3e5e67c76bda 100644
--- a/arch/powerpc/mm/nohash/kaslr_booke.c
+++ b/arch/powerpc/mm/nohash/kaslr_booke.c
@@ -91,7 +91,7 @@ static __init u64 get_kaslr_seed(void *fdt)
        return ret;
 }
 
-static __init bool regions_overlap(u32 s1, u32 e1, u32 s2, u32 e2)
+static __init bool regions_overlap(u64 s1, u64 e1, u64 s2, u64 e2)
 {
        return e1 >= s2 && e2 >= s1;
 }
@@ -100,13 +100,15 @@ static __init bool overlaps_reserved_region(const void 
*fdt, u32 start,
                                            u32 end)
 {
        int subnode, len, i;
-       u64 base, size;
+       u64 base, size, rsv_end;
 
        /* check for overlap with /memreserve/ entries */
        for (i = 0; i < fdt_num_mem_rsv(fdt); i++) {
                if (fdt_get_mem_rsv(fdt, i, &base, &size) < 0)
                        continue;
-               if (regions_overlap(start, end, base, base + size))
+
+               rsv_end = base + min(size, U64_MAX - base);
+               if (regions_overlap(start, end, base, rsv_end))
                        return true;
        }
 
@@ -118,7 +120,6 @@ static __init bool overlaps_reserved_region(const void 
*fdt, u32 start,
             subnode >= 0;
             subnode = fdt_next_subnode(fdt, subnode)) {
                const fdt32_t *reg;
-               u64 rsv_end;
 
                len = 0;
                reg = fdt_getprop(fdt, subnode, "reg", &len);
@@ -141,8 +142,7 @@ static __init bool overlaps_reserved_region(const void 
*fdt, u32 start,
                        if (base >= regions.pa_end)
                                continue;
 
-                       rsv_end = min(base + size, (u64)U32_MAX);
-
+                       rsv_end = base + min(size, U64_MAX - base);
                        if (regions_overlap(start, end, base, rsv_end))
                                return true;
                }