drivers/of: fdt: validate flat DT string properties before string use
PATCH 1/1 drivers/of: fdt: validate flat DT string properties before string use
Firmware-supplied flat DT properties are raw byte sequences. Several early FDT helpers fetch properties such as status, model, compatible, and device_type and then use them as C strings with strcmp(), strlen(), or pr_info() without first proving that the property is NUL-terminated within its declared length.
Use fdt_stringlist_get() for these string properties instead. That preserves the existing behavior for valid DTBs while rejecting malformed unterminated properties before they are passed to C string helpers.
Signed-off-by Pengpeng Hou <[email protected]>
--- drivers/of/fdt.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
drivers/of/fdt.c +11 -14
@@ -68,7 +68,7 @@ void __init of_fdt_limit_memory(int limit)bool of_fdt_device_is_available (const void *blob,unsigned long node) { -const char *status =fdt_getprop (blob, node,"status" ,NULL ); +const char *status =fdt_stringlist_get (blob, node,"status" ,0 ,NULL );if (!status)return true;
@@ -741,9 +741,10 @@ const char * __init of_flat_dt_get_machine_name(void)const char *name;unsigned long dt_root =of_get_flat_dt_root (); - name =of_get_flat_dt_prop (dt_root,"model" ,NULL ); + name =fdt_stringlist_get (initial_boot_params, dt_root,"model" ,0 ,NULL );if (!name) - name =of_get_flat_dt_prop (dt_root,"compatible" ,NULL ); + name =fdt_stringlist_get (initial_boot_params, dt_root, +"compatible" ,0 ,NULL );return name; }
@@ -775,19 +776,14 @@ const void * __init of_flat_dt_match_machine(const void *default_match, }if (!best_data) {const char *prop; -int size; +int idx =0 , size;pr_err ("\n unrecognized device tree list:\n[ " ); - prop =of_get_flat_dt_prop (dt_root,"compatible" , &size); -if (prop) { -while (size >0 ) { -printk ("'%s' " , prop); - size -=strlen (prop) +1 ; - prop +=strlen (prop) +1 ; - } - } -printk ("]\n\n" ); +while ((prop =fdt_stringlist_get (initial_boot_params, dt_root, +"compatible" , idx++, &size))) +pr_err ("'%s' " , prop); +pr_err ("]\n\n" );return NULL ; }
@@ -1032,7 +1028,8 @@ int __init early_init_dt_scan_memory(void)const void *fdt = initial_boot_params;fdt_for_each_subnode (node, fdt,0 ) { -const char *type =of_get_flat_dt_prop (node,"device_type" ,NULL ); +const char *type =fdt_stringlist_get (fdt, node, +"device_type" ,0 ,NULL );const __be32 *reg;int i, l;bool hotpluggable;
Signature · 1 line
2.50.1 (Apple Git-155)