diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-04-05 03:42:00 +0300 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2026-04-10 11:45:42 +0300 |
| commit | f45ab27774aadeee28f093a9f074892e9bebb586 (patch) | |
| tree | 1e7768304f5d9e427d7039b5565b330fd6b56ead | |
| parent | 591cd656a1bf5ea94a222af5ef2ee76df029c1d2 (diff) | |
| download | linux-f45ab27774aadeee28f093a9f074892e9bebb586.tar.xz | |
ARM: xen: validate hypervisor compatible before parsing its version
fdt_find_hyper_node() reads the raw compatible property and then derives
hyper_node.version from a prefix match before later printing it with %s.
Flat DT properties are external boot input, and this path does not prove
that the first compatible entry is NUL-terminated within the returned
property length.
Keep the existing flat-DT lookup path, but verify that the first
compatible entry terminates within the returned property length before
deriving the version suffix from it.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260405094005.5-arm-xen-v2-pengpeng@iscas.ac.cn>
| -rw-r--r-- | arch/arm/xen/enlighten.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c index 4feed2c2498d..25a0ce3b4584 100644 --- a/arch/arm/xen/enlighten.c +++ b/arch/arm/xen/enlighten.c @@ -218,8 +218,9 @@ static __initdata struct { static int __init fdt_find_hyper_node(unsigned long node, const char *uname, int depth, void *data) { - const void *s = NULL; + const char *s = NULL; int len; + size_t prefix_len = strlen(hyper_node.prefix); if (depth != 1 || strcmp(uname, "hypervisor") != 0) return 0; @@ -228,9 +229,10 @@ static int __init fdt_find_hyper_node(unsigned long node, const char *uname, hyper_node.found = true; s = of_get_flat_dt_prop(node, "compatible", &len); - if (strlen(hyper_node.prefix) + 3 < len && - !strncmp(hyper_node.prefix, s, strlen(hyper_node.prefix))) - hyper_node.version = s + strlen(hyper_node.prefix); + if (s && len > 0 && strnlen(s, len) < len && + len > prefix_len + 3 && + !strncmp(hyper_node.prefix, s, prefix_len)) + hyper_node.version = s + prefix_len; /* * Check if Xen supports EFI by checking whether there is the |