From: Pengpeng Hou Date: Fri, 3 Apr 2026 03:55:29 +0000 (+0800) Subject: drivers/of: fdt: validate stdout-path properties before parsing them X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bb04fcc89a889ad7d5e3427cd1afddd924ef691c;p=thirdparty%2Fkernel%2Flinux.git drivers/of: fdt: validate stdout-path properties before parsing them early_init_dt_scan_chosen_stdout() fetches stdout-path and linux,stdout-path directly from the flat DT and immediately passes the result to strchrnul(). Flat DT properties are raw firmware-supplied byte sequences, and this path does not prove that either property is NUL-terminated within its declared bounds. Use fdt_stringlist_get() so malformed unterminated stdout-path properties are rejected before the local parser walks them as C strings. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260403143001.1-dt-fdt-stdout-pengpeng@iscas.ac.cn Signed-off-by: Rob Herring (Arm) --- diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c index 43a0944ca4623..9e4131f0e9b2e 100644 --- a/drivers/of/fdt.c +++ b/drivers/of/fdt.c @@ -954,9 +954,9 @@ int __init early_init_dt_scan_chosen_stdout(void) if (offset < 0) return -ENOENT; - p = fdt_getprop(fdt, offset, "stdout-path", &l); + p = fdt_stringlist_get(fdt, offset, "stdout-path", 0, &l); if (!p) - p = fdt_getprop(fdt, offset, "linux,stdout-path", &l); + p = fdt_stringlist_get(fdt, offset, "linux,stdout-path", 0, &l); if (!p || !l) return -ENOENT;