drivers/of: validate status properties in reconfig state changes

Live-tree reconfiguration properties also carry raw values plus explicit
lengths. `of_reconfig_get_state_change()` currently treats `status`
property values as NUL-terminated strings and feeds them straight into
`strcmp()`.

Factor the `"okay"` / `"ok"` check out into a helper that first verifies
that the property contains a bounded C string within `prop->length`.
Malformed `status` updates should be treated as not enabling the node.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260507081812.91838-2-pengpeng@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index ade288372101bb9d24873a97f96bc52282a81e72..442590d6511a7f607c46792abc9580eccc29bf61 100644 (file)
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -74,6 +74,20 @@ static const char *action_names[] = {
        [OF_RECONFIG_UPDATE_PROPERTY] = "UPDATE_PROPERTY",
 };
 
+static bool of_property_status_ok(const struct property *prop)
+{
+       const char *status;
+
+       if (!prop || !prop->value || prop->length <= 0)
+               return false;
+
+       status = prop->value;
+       if (strnlen(status, prop->length) >= prop->length)
+               return false;
+
+       return !strcmp(status, "okay") || !strcmp(status, "ok");
+}
+
 #define _do_print(func, prefix, action, node, prop, ...) ({    \
        func("changeset: " prefix "%-15s %pOF%s%s\n",           \
             ##__VA_ARGS__, action_names[action], node,         \
@@ -135,11 +149,9 @@ int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *
 
        if (prop && !strcmp(prop->name, "status")) {
                is_status = 1;
-               status_state = !strcmp(prop->value, "okay") ||
-                              !strcmp(prop->value, "ok");
+               status_state = of_property_status_ok(prop);
                if (old_prop)
-                       old_status_state = !strcmp(old_prop->value, "okay") ||
-                                          !strcmp(old_prop->value, "ok");
+                       old_status_state = of_property_status_ok(old_prop);
        }
 
        switch (action) {