From ef701f172839b62143d98f35e2608099deed03e6 Mon Sep 17 00:00:00 2001 From: Nickolai Zeldovich Date: Thu, 1 Oct 2026 17:06:46 -0400 Subject: [PATCH] lib: sbi: Refresh the root memregion count after sanitize_domain() root_add_memregion() counts the regions once, but sanitize_domain() removes covered regions on every iteration, so the merge step's memmove uses a stale count and runs past the terminating entry. It stays in bounds today only because the array has ROOT_REGION_MAX + 1 slots. Recompute the count after each sanitize_domain(). Fixes: 0d5629381731 ("lib: sbi: Fix sbi_domain_root_add_memregion() for merging memregions") Signed-off-by: Nickolai Zeldovich Co-Authored-By: Claude Fable 5.1 --- lib/sbi/sbi_domain.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c index b3f5892d2d..4924e1b1f7 100644 --- a/lib/sbi/sbi_domain.c +++ b/lib/sbi/sbi_domain.c @@ -748,6 +748,12 @@ static int root_add_memregion(const struct sbi_domain_memregion *reg) return rc; } + /* + * sanitize_domain() may have dropped regions covered by + * another region, so the count is stale at this point. + */ + root_memregs_count = sbi_domain_used_memregions(&root); + /* Merge consecutive memregions with same order and flags */ reg_merged = false; sbi_domain_for_each_memregion(&root, nreg) {