[PATCH] ARM: at91: validate memory node device_type strings

[Pengpeng Hou]

at91_pm_backup_scan_memcs() fetches the raw device_type property and
immediately compares it with strcmp(). Flat DT properties are external
boot input, and this path does not prove that the property is
NUL-terminated within its declared bounds.

Use fdt_stringlist_get() so malformed unterminated device_type
properties are rejected before they are used as C strings.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 arch/arm/mach-at91/pm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 68bb4a86cd94..0767fc9f30ab 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -8,6 +8,7 @@
 
 #include <linux/genalloc.h>
 #include <linux/io.h>
+#include <linux/libfdt.h>
 #include <linux/of_address.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
@@ -1044,7 +1045,8 @@ static int __init at91_pm_backup_scan_memcs(unsigned long node,
 	if (*located)
 		return 0;
 
-	type = of_get_flat_dt_prop(node, "device_type", NULL);
+	type = fdt_stringlist_get(initial_boot_params, node, "device_type",
+				  0, NULL);
 
 	/* We are scanning "memory" nodes only. */
 	if (!type || strcmp(type, "memory"))
-- 
2.50.1 (Apple Git-155)