[PATCH 1/2] of: fdt: fix length comparison

[PATCH 1/2] of: fdt: fix length comparison

[Ahmad Fatoum]

From: Steffen Trumtrar <s.trumtrar@pengutronix.de>

If haystack_len equals needle_len the following memcmp would overflow,
because needle_len is incremented in the memcmp.

Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/of/fdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 43bb73b7a2df..5eead271edb7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -698,7 +698,7 @@ static int fdt_string_is_compatible(const char *haystack, int haystack_len,
 	const char *p;
 	int index = 0;
 
-	while (haystack_len >= needle_len) {
+	while (haystack_len > needle_len) {
 		if (memcmp(needle, haystack, needle_len + 1) == 0)
 			return OF_DEVICE_COMPATIBLE_MAX_SCORE - (index << 2);
 
-- 
2.39.5

[PATCH 2/2] of: fdt: verify length within bounds before using it

[Ahmad Fatoum]

We currently call dt_struct_advance() at the end of processing a tag
to advance to the next tag with a check after the switch to verify that
we are within bounds.

This is error prone as it expects that code that comes before it also
checks that len is not exceeded as dt_struct_advance would come too late
to go anything about this.

Avoid this by doing dt_struct_advance earlier in the switch cases and
bailing out directly if sizes aren't sane.

Reported-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/of/fdt.c | 53 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 34 insertions(+), 19 deletions(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 5eead271edb7..9638b3d238be 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -227,6 +227,13 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 				goto err;
 			}
 
+			dt_struct = dt_struct_advance(&f, dt_struct,
+					sizeof(struct fdt_node_header) + len + 1);
+			if (!dt_struct) {
+				ret = -ESPIPE;
+				goto err;
+			}
+
 			if (!node) {
 				/* The root node must have an empty name */
 				if (*pathp) {
@@ -243,9 +250,6 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 				node = of_new_node(node, pathp);
 			}
 
-			dt_struct = dt_struct_advance(&f, dt_struct,
-					sizeof(struct fdt_node_header) + len + 1);
-
 			break;
 
 		case FDT_END_NODE:
@@ -258,6 +262,10 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			node = node->parent;
 
 			dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+			if (!dt_struct) {
+				ret = -ESPIPE;
+				goto err;
+			}
 
 			break;
 
@@ -272,7 +280,14 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			nodep = fdt_prop->data;
 
 			name = dt_string(&f, dt_strings, fdt32_to_cpu(fdt_prop->nameoff));
-			if (!name || !node || is_reserved_name(name)) {
+			if (!name || !node ||  is_reserved_name(name)) {
+				ret = -ESPIPE;
+				goto err;
+			}
+
+			dt_struct = dt_struct_advance(&f, dt_struct,
+					sizeof(struct fdt_property) + len);
+			if (!dt_struct) {
 				ret = -ESPIPE;
 				goto err;
 			}
@@ -285,13 +300,15 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			if (!strcmp(name, "phandle") && len == 4)
 				node->phandle = be32_to_cpup(of_property_get_value(p));
 
-			dt_struct = dt_struct_advance(&f, dt_struct,
-					sizeof(struct fdt_property) + len);
 
 			break;
 
 		case FDT_NOP:
 			dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+			if (!dt_struct) {
+				ret = -ESPIPE;
+				goto err;
+			}
 
 			break;
 
@@ -303,11 +320,6 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			ret = -EINVAL;
 			goto err;
 		}
-
-		if (!dt_struct) {
-			ret = -ESPIPE;
-			goto err;
-		}
 	}
 err:
 	of_delete_node(root);
@@ -752,6 +764,8 @@ int fdt_machine_is_compatible(const struct fdt_header *fdt, size_t fdt_size, con
 
 			dt_struct = dt_struct_advance(&f, dt_struct,
 					sizeof(struct fdt_node_header) + 1);
+			if (!dt_struct)
+				return 0;
 
 			/*
 			 * Quoting Device Tree Specification v0.4 §5.4.2:
@@ -775,24 +789,25 @@ int fdt_machine_is_compatible(const struct fdt_header *fdt, size_t fdt_size, con
 			if (!name)
 				return 0;
 
-			if (strcmp(name, "compatible")) {
-				dt_struct = dt_struct_advance(&f, dt_struct,
-							      sizeof(struct fdt_property) + len);
-				break;
-			}
+			dt_struct = dt_struct_advance(&f, dt_struct,
+						      sizeof(struct fdt_property) + len);
+			if (!dt_struct)
+				return 0;
+
+			if (strcmp(name, "compatible"))
+				continue;
 
 			return fdt_string_is_compatible(fdt_prop->data, len, compat, compat_len);
 
 		case FDT_NOP:
 			dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
+			if (!dt_struct)
+				return 0;
 			break;
 
 		default:
 			return 0;
 		}
-
-		if (!dt_struct)
-			return 0;
 	}
 
 	return 0;
-- 
2.39.5

Re: [PATCH 1/2] of: fdt: fix length comparison

[Sascha Hauer]

On Thu, 05 Jun 2025 13:26:06 +0200, Ahmad Fatoum wrote:
> If haystack_len equals needle_len the following memcmp would overflow,
> because needle_len is incremented in the memcmp.
> 
> 

Applied, thanks!

[1/2] of: fdt: fix length comparison
      https://git.pengutronix.de/cgit/barebox/commit/?id=76f09774c553 (link may not be stable)
[2/2] of: fdt: verify length within bounds before using it
      https://git.pengutronix.de/cgit/barebox/commit/?id=d31119846cff (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>