diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-04-03 11:55:29 +0800 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-04-13 15:01:26 -0500 |
| commit | bb04fcc89a889ad7d5e3427cd1afddd924ef691c (patch) | |
| tree | 82b59efa73d20b089eff56b290706d2c437b99da | |
| parent | 38fe5379504ffd300f8546249ffa0e8d0000e94c (diff) | |
drivers/of: fdt: validate stdout-path properties before parsing them
early_init_dt_scan_chosen_stdout() fetches stdout-path and
linux,stdout-path directly from the flat DT and immediately passes the
result to strchrnul(). Flat DT properties are raw firmware-supplied
byte sequences, and this path does not prove that either property is
NUL-terminated within its declared bounds.
Use fdt_stringlist_get() so malformed unterminated stdout-path
properties are rejected before the local parser walks them as C
strings.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260403143001.1-dt-fdt-stdout-pengpeng@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
| -rw-r--r-- | drivers/of/fdt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c index 43a0944ca462..9e4131f0e9b2 100644 --- a/drivers/of/fdt.c +++ b/drivers/of/fdt.c @@ -954,9 +954,9 @@ int __init early_init_dt_scan_chosen_stdout(void) if (offset < 0) return -ENOENT; - p = fdt_getprop(fdt, offset, "stdout-path", &l); + p = fdt_stringlist_get(fdt, offset, "stdout-path", 0, &l); if (!p) - p = fdt_getprop(fdt, offset, "linux,stdout-path", &l); + p = fdt_stringlist_get(fdt, offset, "linux,stdout-path", 0, &l); if (!p || !l) return -ENOENT; |