]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drivers/of: validate live-tree string properties before string use
authorPengpeng Hou <pengpeng@iscas.ac.cn>
Thu, 7 May 2026 08:18:10 +0000 (16:18 +0800)
committerRob Herring (Arm) <robh@kernel.org>
Wed, 13 May 2026 22:18:01 +0000 (17:18 -0500)
commit1e54c31b9cbbb42162e2e4317c18c8a8b350a79d
tree425162ce8b22f96107b042e8f59d4331f0768750
parent76b86d050bd53e0c89e19d8f78b241c4527dac9e
drivers/of: validate live-tree string properties before string use

`populate_properties()` stores live-tree property values as raw byte
sequences plus a separate `length`. They are not globally guaranteed to
be NUL-terminated.

`of_prop_next_string()` iterates string-list properties by walking raw
bytes, `__of_node_is_type()` checks `device_type`,
`__of_device_is_status()` checks `status`, and
`of_alias_from_compatible()` reads the first `compatible` entry. These
paths must validate that the relevant string fits within the property
bounds before they hand it to C string helpers.

Validate these live-tree string properties within their declared bounds.
In particular, make `of_prop_next_string()` reject malformed entries
before returning them, keep the `device_type` check inside the existing
no-lock helper path, and add unit coverage for malformed first and
trailing string-list entries.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260507081812.91838-1-pengpeng@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
drivers/of/base.c
drivers/of/property.c
drivers/of/unittest.c