Re: [PATCH v2] libfdt: fdt_get_alias_namelen: Validate aliases

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 1573 bytes --]

On Tue, Oct 10, 2023 at 10:26:43AM +0100, Pierre-Clément Tosi wrote:
> On Tue, Oct 10, 2023 at 03:56:19PM +1100, David Gibson wrote:
> > On Mon, Oct 09, 2023 at 03:20:04PM +0100, Pierre-Clément Tosi wrote:
> > > Ensure that the alias found matches the device tree specification v0.4:
> > > 
> > >     Each property of the /aliases node defines an alias. The property
> > >     name specifies the alias name. The property value specifies the full
> > >     path to a node in the devicetree.
> > > 
> > > This protects against a stack overflow caused by
> > > 
> > >     fdt_path_offset_namelen(fdt, path, namelen)
> > > 
> > > calling (if 'path' contains no '/')
> > 
> > Uh.. this still seems confusing, or at least misleadingly specific.
> > Having a self-referential alias doesn't really have anything to do
> > with whether the path has any '/' or not.
> 
> Because, even if fdt_path_offset() is called with a path containing one or more
> '/', the recursion will result in a fdt_path_offset() call with a path that
> doesn't have one, right?

Well, not necessarily, but you can get a loop even without that.  Most
trivially with:
	aliases {
		loop = "loop/some/path/or/other"
	};

As long as the first call to fdt_path_offset() has a '/' in it, so
will every subsequent one, but you'll still get infinite recursion
trying to resolve 'loop'.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]