From: "Rob Herring (Arm)" <robh@kernel.org>
To: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Cc: Saravana Kannan <saravanak@kernel.org>,
stable@vger.kernel.org, linux-kernel@vger.kernel.org,
devicetree@vger.kernel.org,
Grant Likely <grant.likely@secretlab.ca>,
"David S. Miller" <davem@davemloft.net>,
Shawn Guo <shawn.guo@linaro.org>,
Frank Rowand <frowand.list@gmail.com>
Subject: Re: [PATCH v6 01/10] of: fix out-of-bounds read in of_alias_scan() stem parser
Date: Thu, 27 Aug 2026 09:36:09 -0500 [thread overview]
Message-ID: <178784136621.3211641.12231843350175414585.robh@kernel.org> (raw)
In-Reply-To: <20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai>
On Wed, 05 Aug 2026 13:31:00 -0700, Abdurrahman Hussain wrote:
> The stem parser tests isdigit(*(end - 1)) before checking end > start
> and so reads one byte before the property name when the name is empty
> or all digits. Check the bound first.
>
> Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-fable-5 [Claude Code]
> Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
> ---
> drivers/of/base.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Applied, thanks!
next prev parent reply other threads:[~2026-08-27 14:36 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-05 20:30 [PATCH v6 00/10] of: teach overlay code to keep /aliases in sync Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 01/10] of: fix out-of-bounds read in of_alias_scan() stem parser Abdurrahman Hussain
2026-08-06 8:10 ` Geert Uytterhoeven
2026-08-27 14:36 ` Rob Herring (Arm) [this message]
2026-08-05 20:31 ` [PATCH v6 02/10] of: hold a reference on of_aliases during alias path resolution Abdurrahman Hussain
2026-08-05 20:52 ` sashiko-bot
2026-08-27 14:52 ` Rob Herring
2026-08-27 20:20 ` Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 03/10] of: update /aliases lookup on reconfig notifications Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 04/10] of/overlay: look up absolute target-paths absolutely Abdurrahman Hussain
2026-08-05 20:40 ` sashiko-bot
2026-08-27 20:32 ` Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 05/10] of/overlay: put property on deadprops only after changeset add succeeds Abdurrahman Hussain
2026-08-05 20:45 ` sashiko-bot
2026-08-05 20:31 ` [PATCH v6 06/10] of/overlay: only treat a positive changeset id as registered Abdurrahman Hussain
2026-08-05 20:42 ` sashiko-bot
2026-08-06 7:52 ` Geert Uytterhoeven
2026-08-05 20:31 ` [PATCH v6 07/10] of/overlay: don't create "//" paths for fragments targeting the root Abdurrahman Hussain
2026-08-05 20:45 ` sashiko-bot
2026-08-05 20:31 ` [PATCH v6 08/10] of/overlay: return ERR_PTR from dup_and_fixup_symbol_prop() Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 09/10] of/overlay: rewrite /aliases path values to live-tree paths Abdurrahman Hussain
2026-08-05 20:31 ` [PATCH v6 10/10] of: unittest: cover /aliases updates from overlay apply/revert Abdurrahman Hussain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178784136621.3211641.12231843350175414585.robh@kernel.org \
--to=robh@kernel.org \
--cc=abdurrahman@nexthop.ai \
--cc=davem@davemloft.net \
--cc=devicetree@vger.kernel.org \
--cc=frowand.list@gmail.com \
--cc=grant.likely@secretlab.ca \
--cc=linux-kernel@vger.kernel.org \
--cc=saravanak@kernel.org \
--cc=shawn.guo@linaro.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox