[PATCH v2] ARM: mvebu: validate memory node device_type before strcmp()

[Pengpeng Hou]

mvebu_scan_mem() fetches the flat-DT device_type property and immediately
compares it with strcmp(). Flat DT properties are external boot input,
and this path does not prove that the property is NUL-terminated within
the returned property length.

Keep the existing flat-DT lookup path, but reject malformed
unterminated device_type values before comparing them as C strings.
This preserves the current distinction between an absent property and a
bad property value.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
Changes since v1:
- keep `of_get_flat_dt_prop()` instead of switching to `fdt_stringlist_get()`
- preserve the existing â??not foundâ?? vs malformed-value behavior

 arch/arm/mach-mvebu/board-v7.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-mvebu/board-v7.c b/arch/arm/mach-mvebu/board-v7.c
index a0740ab0..db6543ff 100644
--- a/arch/arm/mach-mvebu/board-v7.c
+++ b/arch/arm/mach-mvebu/board-v7.c
@@ -66,11 +66,13 @@ void __iomem *mvebu_get_scu_base(void)
 static int __init mvebu_scan_mem(unsigned long node, const char *uname,
 				 int depth, void *data)
 {
-	const char *type = of_get_flat_dt_prop(node, "device_type", NULL);
+	const char *type;
 	const __be32 *reg, *endp;
-	int l;
+	int len, l;
 
-	if (type == NULL || strcmp(type, "memory"))
+	type = of_get_flat_dt_prop(node, "device_type", &len);
+
+	if (!type || strnlen(type, len) >= len || strcmp(type, "memory"))
 		return 0;
 
 	reg = of_get_flat_dt_prop(node, "linux,usable-memory", &l);
-- 
2.50.1