[PATCH v1] board: mpfs_icicle: fix board_fit_config_name_match()

[PATCH v1] board: mpfs_icicle: fix board_fit_config_name_match()

[Conor Dooley]

From: Conor Dooley <conor.dooley@microchip.com>

The loop in the icicle implementation of board_fit_config_name_match()
runs strtok() to split off the vendor portion of the compatible string
using , as the delimiter. strtok() modifies a string in place, so where
the first config and compatible do not match, the compatible has been
modified by the time the loop hits the second iteration.
Since stringlists in dt land are null separated strings, the nulls
strtok() inserts to replace the delimiter increase the number of strings
in the compatible list. When the second iteration of the loop calls
fdt_stringlist_get(), it gets the vendorless portion of the first
compatible string, rather than the second compatible string. Copy each
compatible before calling strtok() to avoid this problem.

The temporary string the compatible is copied to is statically
allocated, as attempts to dynamically allocate it at this stage of boot
were met with "alloc space exhausted" errors.

Fixes: 7c16ebba1ed ("board: mpfs_icicle: implement board_fdt_blob_setup()/board_fit_config_name_match()")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
---
CC: Conor Dooley <conor.dooley@microchip.com>
CC: Cyril Jean <cyril.jean@microchip.com>
CC: Tom Rini <trini@konsulko.com>
CC: Leo Yu-Chi Liang <ycliang@andestech.com>
CC: u-boot@lists.denx.de
---
 board/microchip/mpfs_icicle/mpfs_icicle.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/board/microchip/mpfs_icicle/mpfs_icicle.c b/board/microchip/mpfs_icicle/mpfs_icicle.c
index 6b6984eae3f..ba622e38ee5 100644
--- a/board/microchip/mpfs_icicle/mpfs_icicle.c
+++ b/board/microchip/mpfs_icicle/mpfs_icicle.c
@@ -73,13 +73,22 @@ int board_fit_config_name_match(const char *name)
 	for (int i = 0; i < list_len; i++) {
 		int len, match;
 		const char *compat;
+		char copy[64];
 		char *devendored;
 
 		compat = fdt_stringlist_get(fdt, 0, "compatible", i, &len);
 		if (!compat)
 			return -EINVAL;
 
-		strtok((char *)compat, ",");
+		/*
+		 * The naming scheme for compatibles doesn't produce anything
+		 * close to this long.
+		 */
+		if (len >= 64)
+			return -EINVAL;
+
+		strncpy(copy, compat, 64);
+		strtok(copy, ",");
 
 		devendored = strtok(NULL, ",");
 		if (!devendored)
-- 
2.45.2

Re: [PATCH v1] board: mpfs_icicle: fix board_fit_config_name_match()

[Leo Liang]

On Mon, Jul 07, 2025 at 01:13:33PM +0100, Conor Dooley wrote:
> From: Conor Dooley <conor.dooley@microchip.com>
> 
> The loop in the icicle implementation of board_fit_config_name_match()
> runs strtok() to split off the vendor portion of the compatible string
> using , as the delimiter. strtok() modifies a string in place, so where
> the first config and compatible do not match, the compatible has been
> modified by the time the loop hits the second iteration.
> Since stringlists in dt land are null separated strings, the nulls
> strtok() inserts to replace the delimiter increase the number of strings
> in the compatible list. When the second iteration of the loop calls
> fdt_stringlist_get(), it gets the vendorless portion of the first
> compatible string, rather than the second compatible string. Copy each
> compatible before calling strtok() to avoid this problem.
> 
> The temporary string the compatible is copied to is statically
> allocated, as attempts to dynamically allocate it at this stage of boot
> were met with "alloc space exhausted" errors.
> 
> Fixes: 7c16ebba1ed ("board: mpfs_icicle: implement board_fdt_blob_setup()/board_fit_config_name_match()")
> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
> ---
> CC: Conor Dooley <conor.dooley@microchip.com>
> CC: Cyril Jean <cyril.jean@microchip.com>
> CC: Tom Rini <trini@konsulko.com>
> CC: Leo Yu-Chi Liang <ycliang@andestech.com>
> CC: u-boot@lists.denx.de
> ---
>  board/microchip/mpfs_icicle/mpfs_icicle.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)

Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>