From: Ahmad Fatoum <[email protected]>
of_alias_resolve() passes the value of an /aliases property straight
to of_find_node_by_path_from() as a C string. Unflattened property
values are copied with their exact length, so a value without a
terminating NUL makes the path lookup read past the end of the
allocation.
Only devicetrees barebox trusts get here.
Still, let's skip such values like libfdt's fdt_get_alias_namelen()
does.
Fixes: 58f3457f4f03 ("of: add devicetree probing support")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
drivers/of/base.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 194888359345..1987f9c8b0ca 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -22,6 +22,7 @@
#include <linux/clk.h>
#include <linux/ctype.h>
#include <linux/err.h>
+#include <linux/string_helpers.h>
#include <pm_domain.h>
#include <tee/optee.h>
@@ -178,13 +179,18 @@ static void of_alias_add(struct alias_prop *ap, struct
device_node *np,
static struct device_node *of_alias_resolve(struct device_node *root, struct
property *pp)
{
+ const char *path = of_property_get_value(pp);
+
/* Skip those we do not want to proceed */
if (!of_prop_cmp(pp->name, "name") ||
!of_prop_cmp(pp->name, "phandle") ||
!of_prop_cmp(pp->name, "linux,phandle"))
return NULL;
- return of_find_node_by_path_from(root, of_property_get_value(pp));
+ if (!path || !string_is_terminated(path, pp->length))
+ return NULL;
+
+ return of_find_node_by_path_from(root, path);
}
static int of_alias_id_parse(const char *start, int *len)
--
2.47.3
