github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

arc: validate DT CPU map strings before parsing them

Browse Source 
arc_get_cpu_map() fetches the possible-cpus or present-cpus property
from the flat DT and immediately passes the raw pointer to
cpulist_parse(). That parser expects a NUL-terminated text buffer, but
this path does not prove that the DT property is terminated within its
declared bounds.

Reject unterminated CPU-map properties before handing them to
cpulist_parse().

Changes since v1:
- fold the NUL-termination check into the initial lookup test, as
  suggested by Vineet Gupta

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Vineet Gupta <vgupta@kernel.org>
This commit is contained in:
Pengpeng Hou 2026-07-10 15:26:04 -07:00 committed by Vineet Gupta
parent 8cdeaa50ea
commit 460511c11f
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
arch/arc/kernel/smp.c
View File

@ -22,6 +22,7 @@
#include <linux/irqdomain.h>
#include <linux/export.h>
#include <linux/of_fdt.h>
#include <linux/string.h>
#include <asm/mach_desc.h>
#include <asm/setup.h>
@ -43,9 +44,10 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
{
unsigned long dt_root = of_get_flat_dt_root();
const char *buf;
int len;
buf = of_get_flat_dt_prop(dt_root, name, NULL);
if (!buf)
buf = of_get_flat_dt_prop(dt_root, name, &len);
if (!buf || !memchr(buf, '\0', len))
return -EINVAL;
if (cpulist_parse(buf, cpumask))