diff options
| author | Abdurrahman Hussain <abdurrahman@nexthop.ai> | 2026-08-05 13:31:00 -0700 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-08-27 09:36:05 -0500 |
| commit | 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f (patch) | |
| tree | 3323596b26642fd08d3f4960dbef413dfd51641d /drivers | |
| parent | fe66c3ff85e85d492673c6dc95c3d624a63e0282 (diff) | |
| download | linux-5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f.tar.gz linux-5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f.zip | |
of: fix out-of-bounds read in of_alias_scan() stem parser
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/of/base.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/of/base.c b/drivers/of/base.c index dd7dda0e0a57..378703dbc11f 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -1971,7 +1971,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align)) /* walk the alias backwards to extract the id and work out * the 'stem' string */ - while (isdigit(*(end-1)) && end > start) + while (end > start && isdigit(*(end - 1))) end--; len = end - start; |