All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vineet Gupta <vineet.gupta@linux.dev>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>, Vineet Gupta <vgupta@kernel.org>
Cc: linux-snps-arc@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] arc: validate DT CPU map strings before parsing them
Date: Sun, 5 Apr 2026 14:35:45 -0700	[thread overview]
Message-ID: <c5d35809-293d-4bfe-bc94-d880980480c5@linux.dev> (raw)
In-Reply-To: <20260403161002.2-arc-dt-cpumap-pengpeng@iscas.ac.cn>

On 4/2/26 22:41, Pengpeng Hou wrote:
> arc_get_cpu_map() fetches the possible-cpus or present-cpus property
> from the flat DT and immediately passes the raw pointer to
> cpulist_parse(). That parser expects a NUL-terminated text buffer, but
> this path does not prove that the DT property is terminated within its
> declared bounds.
>
> Reject unterminated CPU-map properties before handing them to
> cpulist_parse().


Seems like a reasonable improvement.


> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   arch/arc/kernel/smp.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
> index b2f2c59279a6..e0f8218e9172 100644
> --- a/arch/arc/kernel/smp.c
> +++ b/arch/arc/kernel/smp.c
> @@ -22,6 +22,7 @@
>   #include <linux/irqdomain.h>
>   #include <linux/export.h>
>   #include <linux/of_fdt.h>
> +#include <linux/string.h>
>   
>   #include <asm/mach_desc.h>
>   #include <asm/setup.h>
> @@ -43,11 +44,15 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
>   {
>   	unsigned long dt_root = of_get_flat_dt_root();
>   	const char *buf;
> +	int len;
>   
> -	buf = of_get_flat_dt_prop(dt_root, name, NULL);
> +	buf = of_get_flat_dt_prop(dt_root, name, &len);
>   	if (!buf)
>   		return -EINVAL;
>   
> +	if (!memchr(buf, '\0', len))
> +		return -EINVAL;
> +


Maybe fold this check into first one as !buf || !memchr(...)

Thx,
-Vineet

_______________________________________________
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

WARNING: multiple messages have this Message-ID (diff)
From: Vineet Gupta <vineet.gupta@linux.dev>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>, Vineet Gupta <vgupta@kernel.org>
Cc: linux-snps-arc@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] arc: validate DT CPU map strings before parsing them
Date: Sun, 5 Apr 2026 14:35:45 -0700	[thread overview]
Message-ID: <c5d35809-293d-4bfe-bc94-d880980480c5@linux.dev> (raw)
In-Reply-To: <20260403161002.2-arc-dt-cpumap-pengpeng@iscas.ac.cn>

On 4/2/26 22:41, Pengpeng Hou wrote:
> arc_get_cpu_map() fetches the possible-cpus or present-cpus property
> from the flat DT and immediately passes the raw pointer to
> cpulist_parse(). That parser expects a NUL-terminated text buffer, but
> this path does not prove that the DT property is terminated within its
> declared bounds.
>
> Reject unterminated CPU-map properties before handing them to
> cpulist_parse().


Seems like a reasonable improvement.


> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   arch/arc/kernel/smp.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
> index b2f2c59279a6..e0f8218e9172 100644
> --- a/arch/arc/kernel/smp.c
> +++ b/arch/arc/kernel/smp.c
> @@ -22,6 +22,7 @@
>   #include <linux/irqdomain.h>
>   #include <linux/export.h>
>   #include <linux/of_fdt.h>
> +#include <linux/string.h>
>   
>   #include <asm/mach_desc.h>
>   #include <asm/setup.h>
> @@ -43,11 +44,15 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
>   {
>   	unsigned long dt_root = of_get_flat_dt_root();
>   	const char *buf;
> +	int len;
>   
> -	buf = of_get_flat_dt_prop(dt_root, name, NULL);
> +	buf = of_get_flat_dt_prop(dt_root, name, &len);
>   	if (!buf)
>   		return -EINVAL;
>   
> +	if (!memchr(buf, '\0', len))
> +		return -EINVAL;
> +


Maybe fold this check into first one as !buf || !memchr(...)

Thx,
-Vineet

  reply	other threads:[~2026-04-05 21:36 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-03  5:41 [PATCH] arc: validate DT CPU map strings before parsing them Pengpeng Hou
2026-04-03  5:41 ` Pengpeng Hou
2026-04-05 21:35 ` Vineet Gupta [this message]
2026-04-05 21:35   ` Vineet Gupta
2026-04-06  7:00 ` [PATCH v2] " Pengpeng Hou
2026-04-06  7:00   ` Pengpeng Hou
2026-04-12 19:35   ` Vineet Gupta
2026-04-12 19:35     ` Vineet Gupta
2026-04-06  7:20 ` [PATCH] " Pengpeng Hou
2026-04-06  7:20   ` Pengpeng Hou

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c5d35809-293d-4bfe-bc94-d880980480c5@linux.dev \
    --to=vineet.gupta@linux.dev \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-snps-arc@lists.infradead.org \
    --cc=pengpeng@iscas.ac.cn \
    --cc=vgupta@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.