github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drivers/of: validate live-tree string properties before string use

Browse Source 
`populate_properties()` stores live-tree property values as raw byte
sequences plus a separate `length`. They are not globally guaranteed to
be NUL-terminated.

`of_prop_next_string()` iterates string-list properties by walking raw
bytes, `__of_node_is_type()` checks `device_type`,
`__of_device_is_status()` checks `status`, and
`of_alias_from_compatible()` reads the first `compatible` entry. These
paths must validate that the relevant string fits within the property
bounds before they hand it to C string helpers.

Validate these live-tree string properties within their declared bounds.
In particular, make `of_prop_next_string()` reject malformed entries
before returning them, keep the `device_type` check inside the existing
no-lock helper path, and add unit coverage for malformed first and
trailing string-list entries.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260507081812.91838-1-pengpeng@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
This commit is contained in:
Pengpeng Hou 2026-05-07 16:18:10 +08:00 committed by Rob Herring (Arm)
parent 76b86d050b
commit 1e54c31b9c
3 changed files with 79 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
drivers/of/base.c
View File

@ -82,9 +82,17 @@ EXPORT_SYMBOL(of_node_name_prefix);
static bool __of_node_is_type(const struct device_node *np, const char *type)
{
const char *match = __of_get_property(np, "device_type", NULL);
const char *match;
int len;
return np && match && type && !strcmp(match, type);
if (!np || !type)
return false;
match = __of_get_property(np, "device_type", &len);
if (!match || len <= 0 || strnlen(match, len) >= len)
return false;
return !strcmp(match, type);
}
#define EXCLUDED_DEFAULT_CELLS_PLATFORMS ( \
@ -511,22 +519,22 @@ static bool __of_device_is_status(const struct device_node *device,
return false;
status = __of_get_property(device, "status", &statlen);
if (status == NULL)
if (!status || statlen <= 0)
return false;
if (strnlen(status, statlen) >= statlen)
return false;
if (statlen > 0) {
while (*strings) {
unsigned int len = strlen(*strings);
while (*strings) {
unsigned int len = strlen(*strings);
if ((*strings)[len - 1] == '-') {
if (!strncmp(status, *strings, len))
return true;
} else {
if (!strcmp(status, *strings))
return true;
}
strings++;
if ((*strings)[len - 1] == '-') {
if (!strncmp(status, *strings, len))
return true;
} else {
if (!strcmp(status, *strings))
return true;
}
strings++;
}
return false;
@ -1237,10 +1245,11 @@ EXPORT_SYMBOL(of_find_matching_node_and_match);
int of_alias_from_compatible(const struct device_node *node, char *alias, int len)
{
const char *compatible, *p;
int cplen;
int ret;
compatible = of_get_property(node, "compatible", &cplen);
if (!compatible || strlen(compatible) > cplen)
ret = of_property_read_string_index(node, "compatible", 0,
&compatible);
if (ret)
return -ENODEV;
p = strchr(compatible, ',');
strscpy(alias, p ? p + 1 : compatible, len);

27
drivers/of/property.c
View File

@ -648,16 +648,31 @@ EXPORT_SYMBOL_GPL(of_prop_next_u32);
const char *of_prop_next_string(const struct property *prop, const char *cur)
{
const void *curv = cur;
const char *curv;
const char *end;
size_t len;
if (!prop)
if (!prop || !prop->value || !prop->length)
return NULL;
if (!cur)
return prop->value;
curv = cur ? cur : prop->value;
end = prop->value + prop->length;
curv += strlen(cur) + 1;
if (curv >= prop->value + prop->length)
if (curv < (const char *)prop->value || curv >= end)
return NULL;
if (cur) {
len = strnlen(curv, end - curv);
if (len >= end - curv)
return NULL;
curv += len + 1;
if (curv >= end)
return NULL;
}
len = strnlen(curv, end - curv);
if (len >= end - curv)
return NULL;
return curv;

32
drivers/of/unittest.c
View File

@ -713,6 +713,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
static void __init of_unittest_property_string(void)
{
const char *strings[4];
const struct property *prop;
struct device_node *np;
int rc;
@ -789,6 +790,37 @@ static void __init of_unittest_property_string(void)
strings[1] = NULL;
rc = of_property_read_string_array(np, "phandle-list-names", strings, 1);
unittest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]);
/* of_prop_next_string() tests */
prop = of_find_property(np, "phandle-list-names", NULL);
strings[0] = of_prop_next_string(prop, NULL);
unittest(strings[0] && !strcmp(strings[0], "first"),
"of_prop_next_string() failure; got '%s'\n", strings[0]);
strings[0] = of_prop_next_string(prop, strings[0]);
unittest(strings[0] && !strcmp(strings[0], "second"),
"of_prop_next_string() failure; got '%s'\n", strings[0]);
strings[0] = of_prop_next_string(prop, strings[0]);
unittest(strings[0] && !strcmp(strings[0], "third"),
"of_prop_next_string() failure; got '%s'\n", strings[0]);
strings[0] = of_prop_next_string(prop, strings[0]);
unittest(!strings[0],
"of_prop_next_string() should return NULL at end of list\n");
prop = of_find_property(np, "unterminated-string", NULL);
strings[0] = of_prop_next_string(prop, NULL);
unittest(!strings[0],
"of_prop_next_string() should reject unterminated first string\n");
prop = of_find_property(np, "unterminated-string-list", NULL);
strings[0] = of_prop_next_string(prop, NULL);
unittest(strings[0] && !strcmp(strings[0], "first"),
"of_prop_next_string() failure; got '%s'\n", strings[0]);
strings[0] = of_prop_next_string(prop, strings[0]);
unittest(strings[0] && !strcmp(strings[0], "second"),
"of_prop_next_string() failure; got '%s'\n", strings[0]);
strings[0] = of_prop_next_string(prop, strings[0]);
unittest(!strings[0],
"of_prop_next_string() should reject unterminated trailing string\n");
}
#define propcmp(p1, p2) (((p1)->length == (p2)->length) && \