Re: [PATCH] libfdt: Fix fdt_get_path() reading before the start of the buffer

[Herve Codina <herve.codina@bootlin.com>]

Hi Ayan,

On Thu, 1 Oct 2026 13:10:36 +0100
Ayan Kumar Halder <ayan.kumar.halder@amd.com> wrote:

> fdt_get_path() walks the tree from the root, appending each node's name
> to the caller's buffer as it goes down and removing the last component
> again as it comes back up.  It keeps the number of components currently
> in the buffer in pdepth, and removes components while pdepth is greater
> than the depth reported by fdt_next_node().
> 
> fdt_next_node() reports that it has left the tree by taking the depth
> negative, but the offset it returns at that point is the offset of the
> end tag, which is not negative.  The loop only tests the offset, so for a

fdt_next_node() returns an error (-FDT_ERR_NOTFOUND) when it reaches the
FDT_END tag [1].

I don't understand your point. Maybe I've missed something.
Can you clarify?

[1] https://github.com/dgibson/dtc/blob/7a1e017926004ecff5fce62d62d42ce9f3e00082/libfdt/fdt.c#L283

> nodeoffset at or past the end tag it runs one more time with a negative
> depth.  pdepth still counts the components in the buffer, so the removal
> loop is asked to remove more components than are there: it takes the
> index down to zero and carries on scanning backwards for a '/' that is
> not in the buffer.
> 
> Stop the walk when the depth shows it has left the tree.  Offsets that
> far along are rejected by the error paths below in any case, so this
> does not change what callers see.

If fdt_next_node() can return an offset (positive value) which is not pointing
to a node without any errors (negative returned value), fdt_next_node() has
to be fixed not callers.

Can you give details leading fdt_next_node() returning a valid offset which
doesn't point to a node?

Best regards,
Hervé

> 
> Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
> ---
>  libfdt/fdt_ro.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libfdt/fdt_ro.c b/libfdt/fdt_ro.c
> index 11f2e2e..32689c7 100644
> --- a/libfdt/fdt_ro.c
> +++ b/libfdt/fdt_ro.c
> @@ -582,7 +582,7 @@ int fdt_get_path(const void *fdt, int nodeoffset, char *buf, int buflen)
>  		return -FDT_ERR_NOSPACE;
>  
>  	for (offset = 0, depth = 0;
> -	     (offset >= 0) && (offset <= nodeoffset);
> +	     (offset >= 0) && (depth >= 0) && (offset <= nodeoffset);
>  	     offset = fdt_next_node(fdt, offset, &depth)) {
>  		while (pdepth > depth) {
>  			do {