[PATCH 2/3] of: reserved_mem: reject statically placed regions overlapping existing reservations

[Wandun Chen]

From: Wandun Chen <chenwandun@xxxxxxxxxxx>

memblock_reserve() permits overlapping reservations, so a statically
placed region whose 'reg' overlaps an existing one is accepted. The
overlapping memory may then be used by two regions concurrently,
corrupting data; and if the region's driver init later fails,
memblock_phys_free() returns the overlap to the buddy allocator,
corrupting that memory.

Reject the overlap up front. Dynamically allocated regions are
unaffected, as they are allocated from free memory and so cannot
overlap an existing reservation.

Sashiko found this issue in [1].

Fixes: d0b8ed47e83a ("of: reserved_mem: fix reserve memory leak")
Signed-off-by: Wandun Chen <chenwandun@xxxxxxxxxxx>
Link: https://lore.kernel.org/all/20260806100605.2C2C01F000E9@xxxxxxxxxxxxxxx/ [1]
---
 drivers/of/of_reserved_mem.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index f20747725de4..67cb60616fc6 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -146,6 +146,15 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,
 
 		return memblock_mark_nomap(base, size);
 	}
+
+	if (memblock_is_region_reserved(base, size)) {
+		phys_addr_t end = base + size;
+
+		pr_err("Reserved memory: [%pa-%pa] overlaps an existing reservation, ignoring\n",
+		       &base, &end);
+		return -EBUSY;
+	}
+
 	return memblock_reserve(base, size);
 }
 
-- 
2.43.0