[PATCH] arc: validate DT CPU map strings before parsing them

[PATCH] arc: validate DT CPU map strings before parsing them

[Pengpeng Hou]

arc_get_cpu_map() fetches the possible-cpus or present-cpus property
from the flat DT and immediately passes the raw pointer to
cpulist_parse(). That parser expects a NUL-terminated text buffer, but
this path does not prove that the DT property is terminated within its
declared bounds.

Reject unterminated CPU-map properties before handing them to
cpulist_parse().

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/arc/kernel/smp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index b2f2c59279a6..e0f8218e9172 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -22,6 +22,7 @@
 #include <linux/irqdomain.h>
 #include <linux/export.h>
 #include <linux/of_fdt.h>
+#include <linux/string.h>
 
 #include <asm/mach_desc.h>
 #include <asm/setup.h>
@@ -43,11 +44,15 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
 {
 	unsigned long dt_root = of_get_flat_dt_root();
 	const char *buf;
+	int len;
 
-	buf = of_get_flat_dt_prop(dt_root, name, NULL);
+	buf = of_get_flat_dt_prop(dt_root, name, &len);
 	if (!buf)
 		return -EINVAL;
 
+	if (!memchr(buf, '\0', len))
+		return -EINVAL;
+
 	if (cpulist_parse(buf, cpumask))
 		return -EINVAL;
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] arc: validate DT CPU map strings before parsing them

[Vineet Gupta]

On 4/2/26 22:41, Pengpeng Hou wrote:
> arc_get_cpu_map() fetches the possible-cpus or present-cpus property
> from the flat DT and immediately passes the raw pointer to
> cpulist_parse(). That parser expects a NUL-terminated text buffer, but
> this path does not prove that the DT property is terminated within its
> declared bounds.
>
> Reject unterminated CPU-map properties before handing them to
> cpulist_parse().


Seems like a reasonable improvement.


> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   arch/arc/kernel/smp.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
> index b2f2c59279a6..e0f8218e9172 100644
> --- a/arch/arc/kernel/smp.c
> +++ b/arch/arc/kernel/smp.c
> @@ -22,6 +22,7 @@
>   #include <linux/irqdomain.h>
>   #include <linux/export.h>
>   #include <linux/of_fdt.h>
> +#include <linux/string.h>
>   
>   #include <asm/mach_desc.h>
>   #include <asm/setup.h>
> @@ -43,11 +44,15 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
>   {
>   	unsigned long dt_root = of_get_flat_dt_root();
>   	const char *buf;
> +	int len;
>   
> -	buf = of_get_flat_dt_prop(dt_root, name, NULL);
> +	buf = of_get_flat_dt_prop(dt_root, name, &len);
>   	if (!buf)
>   		return -EINVAL;
>   
> +	if (!memchr(buf, '\0', len))
> +		return -EINVAL;
> +


Maybe fold this check into first one as !buf || !memchr(...)

Thx,
-Vineet

[PATCH v2] arc: validate DT CPU map strings before parsing them

[Pengpeng Hou]

arc_get_cpu_map() fetches the possible-cpus or present-cpus property
from the flat DT and immediately passes the raw pointer to
cpulist_parse(). That parser expects a NUL-terminated text buffer, but
this path does not prove that the DT property is terminated within its
declared bounds.

Reject unterminated CPU-map properties before handing them to
cpulist_parse().

Changes since v1:
- fold the NUL-termination check into the initial lookup test, as
  suggested by Vineet Gupta

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/arc/kernel/smp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index b2f2c59279a6..632976c22107 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -22,6 +22,7 @@
 #include <linux/irqdomain.h>
 #include <linux/export.h>
 #include <linux/of_fdt.h>
+#include <linux/string.h>
 
 #include <asm/mach_desc.h>
 #include <asm/setup.h>
@@ -43,9 +44,10 @@ static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
 {
 	unsigned long dt_root = of_get_flat_dt_root();
 	const char *buf;
+	int len;
 
-	buf = of_get_flat_dt_prop(dt_root, name, NULL);
-	if (!buf)
+	buf = of_get_flat_dt_prop(dt_root, name, &len);
+	if (!buf || !memchr(buf, '\0', len))
 		return -EINVAL;
 
 	if (cpulist_parse(buf, cpumask))
 		return -EINVAL;
 
 	return 0;
 }
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] arc: validate DT CPU map strings before parsing them

[Pengpeng Hou]

Hi Vineet,

Thanks. That makes sense.

I'll fold the NUL-termination check into the initial test and resend.

Thanks,
Pengpeng