github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ARM: xen: validate hypervisor compatible before parsing its version

Browse Source 
fdt_find_hyper_node() reads the raw compatible property and then derives
hyper_node.version from a prefix match before later printing it with %s.
Flat DT properties are external boot input, and this path does not prove
that the first compatible entry is NUL-terminated within the returned
property length.

Keep the existing flat-DT lookup path, but verify that the first
compatible entry terminates within the returned property length before
deriving the version suffix from it.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260405094005.5-arm-xen-v2-pengpeng@iscas.ac.cn>
This commit is contained in:
Pengpeng Hou 2026-04-05 08:42:00 +08:00 committed by Juergen Gross
parent 591cd656a1
commit f45ab27774
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
arch/arm/xen/enlighten.c
View File

@ -218,8 +218,9 @@ static __initdata struct {
static int __init fdt_find_hyper_node(unsigned long node, const char *uname,
int depth, void *data)
{
const void *s = NULL;
const char *s = NULL;
int len;
size_t prefix_len = strlen(hyper_node.prefix);
if (depth != 1 || strcmp(uname, "hypervisor") != 0)
return 0;
@ -228,9 +229,10 @@ static int __init fdt_find_hyper_node(unsigned long node, const char *uname,
hyper_node.found = true;
s = of_get_flat_dt_prop(node, "compatible", &len);
if (strlen(hyper_node.prefix) + 3 < len &&
!strncmp(hyper_node.prefix, s, strlen(hyper_node.prefix)))
hyper_node.version = s + strlen(hyper_node.prefix);
if (s && len > 0 && strnlen(s, len) < len &&
len > prefix_len + 3 &&
!strncmp(hyper_node.prefix, s, prefix_len))
hyper_node.version = s + prefix_len;
/*
* Check if Xen supports EFI by checking whether there is the