From f36cb64bd39deecde690efadf4a5d6f8155fcb93 Mon Sep 17 00:00:00 2001 From: Alban Bedel Date: Thu, 18 Jun 2026 17:20:34 +0200 Subject: [PATCH] of: property: Fix of_fwnode_get_reference_args() with negative index fwnode_property_get_reference_args() should return -ENOENT when an out of bound index is passed. An issue arised with the OF backend because the OF API use signed indexes while the fwnode API use unsigned ones. When an index value greater the INT_MAX was passed to the OF backend it got casted to a negative value and it returned -EINVAL instead of -ENOENT. This patch add a check to of_fwnode_get_reference_args() to catch negative index before they are passed to the OF API and return -ENOENT right away. This issue appeared when the following pattern was used in the LED subsystem: index = fwnode_property_match_string(fwnode, "led-names", name) led_node = fwnode_find_reference(fwnode, "leds", index); Unlike the same pattern with the OF API, this pattern implicitly cast the signed return value of fwnode_property_match_string() to an unsigned index leading to the above issue with the OF backend. It can be argued that the return value of fwnode_property_match_string() should be checked separately, but I think there is value in supporting such simple and straight to the point patterns. Link: https://lore.kernel.org/linux-leds/aimVRwJPhlGxsIUj@tom-desktop/T/#mc43cbf7e0599991b56dd0d9680714d28d145fbc8 Cc: Tommaso Merciai Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260618152035.1600436-1-alban.bedel@lht.dlh.de Signed-off-by: Rob Herring (Arm) --- drivers/of/property.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/of/property.c b/drivers/of/property.c index b276d1de32222..72cf12907de03 100644 --- a/drivers/of/property.c +++ b/drivers/of/property.c @@ -1172,6 +1172,14 @@ of_fwnode_get_reference_args(const struct fwnode_handle *fwnode, unsigned int i; int ret; + /* + * This function should return -ENOENT for out of bound indexes, + * but the OF API uses signed indexes and consider negative indexes + * as invalid. Catch them here to correctly implement the fwnode API. + */ + if ((int)index < 0) + return -ENOENT; + if (nargs_prop) ret = of_parse_phandle_with_args(to_of_node(fwnode), prop, nargs_prop, index, &of_args); -- 2.47.3