Re: [PATCH v2 4/7] of: property: fw_devlink: Follow PWM nexus maps

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check in `of_parse_phandle_with_args_map` allows a malformed Devicetree to trigger a stack buffer overflow.
- [High] Missing cycle detection in `of_parse_phandle_with_args_map` allows a malformed Devicetree to cause an infinite loop.
--

commit 17ae1bc408452875cfad3c0d990add52c676f9b9
Author: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>

of: property: fw_devlink: Follow PWM nexus maps

PWM consumers use of_parse_phandle_with_args_map() to resolve specifiers
through pwm-map properties. fw_devlink instead parses the pwms property
as a direct phandle reference, so it records the nexus node as the
supplier rather than the mapped PWM provider.

Use the map-aware parser for pwms so fw_devlink resolves the same
provider as the PWM consumer API. Direct PWM references continue to work
because the map-aware parser returns the original provider when no
pwm-map property is present.

Link: https://lore.kernel.org/all/juuc4af7ndbajcl7gzf4tg5qz2q2j5tt3rvql4jbauradujrre@gc5nbdhhixaf/

> diff --git a/drivers/of/property.c b/drivers/of/property.c
> index eba7e9fe6c386..a9c51d639a2b5 100644
> --- a/drivers/of/property.c
> +++ b/drivers/of/property.c
> @@ -1426,7 +1435,7 @@ DEFINE_SIMPLE_PROP(extcon, "extcon", NULL)
>  DEFINE_SIMPLE_PROP(nvmem_cells, "nvmem-cells", "#nvmem-cell-cells")
>  DEFINE_SIMPLE_PROP(phys, "phys", "#phy-cells")
>  DEFINE_SIMPLE_PROP(wakeup_parent, "wakeup-parent", NULL)
> -DEFINE_SIMPLE_PROP(pwms, "pwms", "#pwm-cells")
> +DEFINE_SIMPLE_NEXUS_PROP(pwms, "pwms", "pwm")

[Severity: Critical]
This isn't a bug introduced by this patch, but this change exposes a
pre-existing stack buffer overflow in of_parse_phandle_with_args_map() by
parsing pwms properties automatically during early boot.

Does this code overflow initial_match_array[]?  If a provider node in a
malformed Devicetree has a #pwm-cells property larger than MAX_PHANDLE_ARGS
(16), list_size is read without bounds checking:

drivers/of/base.c:of_parse_phandle_with_args_map() {
    ...
	/* Precalculate the match array - this simplifies match loop */
	for (i = 0; i < list_size; i++)
		initial_match_array[i] = cpu_to_be32(out_args->args[i]);
    ...
}

Because fw_devlink now automatically calls parse_nexus_prop() and
of_parse_phandle_with_args_map() for all pwms properties, this regression can
now be trivially triggered without requiring consumer drivers to probe.

[Severity: High]
This is also a pre-existing issue, but this patch similarly expands the attack
surface by triggering it automatically during early boot via fw_devlink.

Can this loop run infinitely if the Devicetree contains cyclic phandle maps?

When following <list>-map properties through nexus nodes, there is no cycle
detection or maximum depth limit:

drivers/of/base.c:of_parse_phandle_with_args_map() {
    ...
	while (cur) {
		/* Get the <list>-map property */
		map = of_get_property(cur, map_name, &map_len);
    ...
}

If a pwm-map property contains cyclic references (e.g., node A maps to node B,
and node B maps back to node A), could this cause a system hang or deadlock
during boot?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910-fw-devlink-nexus-ready-v2-0-17ac82dbe226@toradex.com?part=4