* [PATCH 2/2] of: fdt: verify length within bounds before using it
2025-06-05 11:26 [PATCH 1/2] of: fdt: fix length comparison Ahmad Fatoum
@ 2025-06-05 11:26 ` Ahmad Fatoum
2025-06-05 11:57 ` [PATCH 1/2] of: fdt: fix length comparison Sascha Hauer
1 sibling, 0 replies; 3+ messages in thread
From: Ahmad Fatoum @ 2025-06-05 11:26 UTC (permalink / raw)
To: barebox; +Cc: Steffen Trumtrar, Ahmad Fatoum
We currently call dt_struct_advance() at the end of processing a tag
to advance to the next tag with a check after the switch to verify that
we are within bounds.
This is error prone as it expects that code that comes before it also
checks that len is not exceeded as dt_struct_advance would come too late
to go anything about this.
Avoid this by doing dt_struct_advance earlier in the switch cases and
bailing out directly if sizes aren't sane.
Reported-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
drivers/of/fdt.c | 53 +++++++++++++++++++++++++++++++-----------------
1 file changed, 34 insertions(+), 19 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 5eead271edb7..9638b3d238be 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -227,6 +227,13 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
goto err;
}
+ dt_struct = dt_struct_advance(&f, dt_struct,
+ sizeof(struct fdt_node_header) + len + 1);
+ if (!dt_struct) {
+ ret = -ESPIPE;
+ goto err;
+ }
+
if (!node) {
/* The root node must have an empty name */
if (*pathp) {
@@ -243,9 +250,6 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
node = of_new_node(node, pathp);
}
- dt_struct = dt_struct_advance(&f, dt_struct,
- sizeof(struct fdt_node_header) + len + 1);
-
break;
case FDT_END_NODE:
@@ -258,6 +262,10 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
node = node->parent;
dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+ if (!dt_struct) {
+ ret = -ESPIPE;
+ goto err;
+ }
break;
@@ -272,7 +280,14 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
nodep = fdt_prop->data;
name = dt_string(&f, dt_strings, fdt32_to_cpu(fdt_prop->nameoff));
- if (!name || !node || is_reserved_name(name)) {
+ if (!name || !node || is_reserved_name(name)) {
+ ret = -ESPIPE;
+ goto err;
+ }
+
+ dt_struct = dt_struct_advance(&f, dt_struct,
+ sizeof(struct fdt_property) + len);
+ if (!dt_struct) {
ret = -ESPIPE;
goto err;
}
@@ -285,13 +300,15 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
if (!strcmp(name, "phandle") && len == 4)
node->phandle = be32_to_cpup(of_property_get_value(p));
- dt_struct = dt_struct_advance(&f, dt_struct,
- sizeof(struct fdt_property) + len);
break;
case FDT_NOP:
dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+ if (!dt_struct) {
+ ret = -ESPIPE;
+ goto err;
+ }
break;
@@ -303,11 +320,6 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
ret = -EINVAL;
goto err;
}
-
- if (!dt_struct) {
- ret = -ESPIPE;
- goto err;
- }
}
err:
of_delete_node(root);
@@ -752,6 +764,8 @@ int fdt_machine_is_compatible(const struct fdt_header *fdt, size_t fdt_size, con
dt_struct = dt_struct_advance(&f, dt_struct,
sizeof(struct fdt_node_header) + 1);
+ if (!dt_struct)
+ return 0;
/*
* Quoting Device Tree Specification v0.4 §5.4.2:
@@ -775,24 +789,25 @@ int fdt_machine_is_compatible(const struct fdt_header *fdt, size_t fdt_size, con
if (!name)
return 0;
- if (strcmp(name, "compatible")) {
- dt_struct = dt_struct_advance(&f, dt_struct,
- sizeof(struct fdt_property) + len);
- break;
- }
+ dt_struct = dt_struct_advance(&f, dt_struct,
+ sizeof(struct fdt_property) + len);
+ if (!dt_struct)
+ return 0;
+
+ if (strcmp(name, "compatible"))
+ continue;
return fdt_string_is_compatible(fdt_prop->data, len, compat, compat_len);
case FDT_NOP:
dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+ if (!dt_struct)
+ return 0;
break;
default:
return 0;
}
-
- if (!dt_struct)
- return 0;
}
return 0;
--
2.39.5
^ permalink raw reply [flat|nested] 3+ messages in thread