Re: [PATCH] of: base: Handle optional argument in of_parse_phandle_with_args_map()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on `list_size` causes an out-of-bounds stack write and read when `#<list>-cells` exceeds `MAX_PHANDLE_ARGS`.
--

--- Patch [1]: [PATCH] of: base: Handle optional argument in of_parse_phandle_with_args_map() ---
commit 22223dd6c28b67c741e12313ce0dc7dc5d351701
Author: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>

of: base: Handle optional argument in of_parse_phandle_with_args_map()

This commit handles the optional NULL out_args argument by providing a local
on-stack fallback object. This avoids unconditional null pointer dereferences
when the caller only wants to verify if the lookup works without keeping
the result.

Closes: https://lore.kernel.org/all/20260710183359.61D3A1F000E9@smtp.kernel.org/

> diff --git a/drivers/of/base.c b/drivers/of/base.c
> --- a/drivers/of/base.c
> +++ b/drivers/of/base.c
[ ... ]
> @@ -1554,6 +1554,8 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
>  	const __be32 *map, *mask, *pass;
>  	static const __be32 dummy_mask[] = { [0 ... (MAX_PHANDLE_ARGS - 1)] = cpu_to_be32(~0) };
>  	static const __be32 dummy_pass[] = { [0 ... (MAX_PHANDLE_ARGS - 1)] = cpu_to_be32(0) };
> +	struct of_phandle_args _oa = {};
> +	struct of_phandle_args *out_args = _out_args ? _out_args : &_oa;
>  	__be32 initial_match_array[MAX_PHANDLE_ARGS];

[Severity: High]
This is a pre-existing issue, but could a malformed device tree cause an
out-of-bounds stack write to initial_match_array?

Later in of_parse_phandle_with_args_map(), the #<list>-cells property is
read directly into list_size without being bounded to MAX_PHANDLE_ARGS:

	ret = of_property_read_u32(cur, cells_name, &list_size);
	if (ret < 0)
		goto put;

	/* Precalculate the match array - this simplifies match loop */
	for (i = 0; i < list_size; i++)
		initial_match_array[i] = cpu_to_be32(out_args->args[i]);

If a device tree node defines a #<list>-cells value greater than 16, this
loop will read out of bounds from out_args->args and write out of bounds to
the initial_match_array stack buffer.

Does list_size need to be validated against MAX_PHANDLE_ARGS before being
used as a loop limit?

>  	const __be32 *match_array = initial_match_array;
>  	int i, ret, map_len, match;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716-schneider-v7-2-rc1-eip-of-fix-v1-1-9b9383f936c6@bootlin.com?part=1