Re: [PATCH v1 3/3] xen/libfdt: fix UBSAN null pointer in fdt_property()

[Oleksii Kurochko <oleksii.kurochko@gmail.com>]

Hi Michal,

On 5/19/26 10:49 AM, Orzel, Michal wrote:
> Hi Oleksii,
> 
> We treat libfdt as external library and we don't accept any edits here prior to
> first sending a fix to libfdt and then cherry-picking a patch (in fact, afacit
> we then do the libfdt version update).

Thanks for clarifying that.

Just to be sure I don't confuse something.
According to the commit ...:

commit ad9cf6bde5b90d4c1e5a79a2803e98d6344c27d7
Author: Vikram Garhwal <fnu.vikram@xilinx.com>
Date:   Thu Nov 11 23:27:20 2021 -0800

     Update libfdt to v1.6.1

     Update libfdt to v1.6.1 of libfdt taken from 
git://github.com/dgibson/dtc.
     This update is done to support device tree overlays.

... I have to send this patch to git://github.com/dgibson/dtc, right?

~ Oleksii
> On 19-May-26 10:39, Oleksii Kurochko wrote:
>> fdt_property() unconditionally calls memcpy(ptr, val, len) even when
>> len is zero and val is NULL.  This is a legitimate calling convention
>> for adding empty FDT properties such as "interrupt-controller", which
>> carry no payload.
>>
>> In Xen, memcpy() maps to __builtin_memcpy(). The compiler treats
>> __builtin_memcpy as nonnull on its pointer arguments, so UBSAN fires
>> before it can observe that len is zero:
>>    UBSAN: Undefined behaviour in common/libfdt/fdt_sw.c:333:2
>>           null pointer passed as argument 2, declared with nonnull
>>           attribute
>>
>> Guard the memcpy() with a check on len so it is skipped entirely when
>> there is no payload to copy, bringing the code in line with the
>> nonnull contract.
>>
>> Fixes: f0ea06558068 ("libfdt: add version 1.3.0")
>> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>> Reviewed-by: Baptiste Le Duc <baptiste.le-duc@vates.tech>
>> ---
>>   xen/common/libfdt/fdt_sw.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c
>> index 4c569ee7eb0d..96d4cf571319 100644
>> --- a/xen/common/libfdt/fdt_sw.c
>> +++ b/xen/common/libfdt/fdt_sw.c
>> @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len)
>>   	ret = fdt_property_placeholder(fdt, name, len, &ptr);
>>   	if (ret)
>>   		return ret;
>> -	memcpy(ptr, val, len);
>> +	if (len)
>> +		memcpy(ptr, val, len);
>>   	return 0;
>>   }
>>   
>