* [PATCH] drivers/of: fdt: validate stdout-path properties before parsing them
@ 2026-04-03 3:55 Pengpeng Hou
2026-04-13 16:58 ` Rob Herring (Arm)
0 siblings, 1 reply; 2+ messages in thread
From: Pengpeng Hou @ 2026-04-03 3:55 UTC (permalink / raw)
To: Rob Herring, Saravana Kannan; +Cc: devicetree, linux-kernel, pengpeng
early_init_dt_scan_chosen_stdout() fetches stdout-path and
linux,stdout-path directly from the flat DT and immediately passes the
result to strchrnul(). Flat DT properties are raw firmware-supplied
byte sequences, and this path does not prove that either property is
NUL-terminated within its declared bounds.
Use fdt_stringlist_get() so malformed unterminated stdout-path
properties are rejected before the local parser walks them as C
strings.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/of/fdt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 331646d667b9..3dcd20c2fa73 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -954,9 +954,9 @@ int __init early_init_dt_scan_chosen_stdout(void)
if (offset < 0)
return -ENOENT;
- p = fdt_getprop(fdt, offset, "stdout-path", &l);
+ p = fdt_stringlist_get(fdt, offset, "stdout-path", 0, &l);
if (!p)
- p = fdt_getprop(fdt, offset, "linux,stdout-path", &l);
+ p = fdt_stringlist_get(fdt, offset, "linux,stdout-path", 0, &l);
if (!p || !l)
return -ENOENT;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drivers/of: fdt: validate stdout-path properties before parsing them
2026-04-03 3:55 [PATCH] drivers/of: fdt: validate stdout-path properties before parsing them Pengpeng Hou
@ 2026-04-13 16:58 ` Rob Herring (Arm)
0 siblings, 0 replies; 2+ messages in thread
From: Rob Herring (Arm) @ 2026-04-13 16:58 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: devicetree, Saravana Kannan, linux-kernel
On Fri, 03 Apr 2026 11:55:29 +0800, Pengpeng Hou wrote:
> early_init_dt_scan_chosen_stdout() fetches stdout-path and
> linux,stdout-path directly from the flat DT and immediately passes the
> result to strchrnul(). Flat DT properties are raw firmware-supplied
> byte sequences, and this path does not prove that either property is
> NUL-terminated within its declared bounds.
>
> Use fdt_stringlist_get() so malformed unterminated stdout-path
> properties are rejected before the local parser walks them as C
> strings.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/of/fdt.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-13 16:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-03 3:55 [PATCH] drivers/of: fdt: validate stdout-path properties before parsing them Pengpeng Hou
2026-04-13 16:58 ` Rob Herring (Arm)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox