Re: [PATCH v3 1/2] drivers/of: validate live-tree string properties before string use

[Rob Herring (Arm)]

On Thu, 07 May 2026 16:18:10 +0800, Pengpeng Hou wrote:
> `populate_properties()` stores live-tree property values as raw byte
> sequences plus a separate `length`. They are not globally guaranteed to
> be NUL-terminated.
> 
> `of_prop_next_string()` iterates string-list properties by walking raw
> bytes, `__of_node_is_type()` checks `device_type`,
> `__of_device_is_status()` checks `status`, and
> `of_alias_from_compatible()` reads the first `compatible` entry. These
> paths must validate that the relevant string fits within the property
> bounds before they hand it to C string helpers.
> 
> Validate these live-tree string properties within their declared bounds.
> In particular, make `of_prop_next_string()` reject malformed entries
> before returning them, keep the `device_type` check inside the existing
> no-lock helper path, and add unit coverage for malformed first and
> trailing string-list entries.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
> Changes since v2:
> - fix the QEMU virt boot hang reported by Rob Herring: v2 made
>   __of_node_is_type() call of_property_match_string(), which takes
>   devtree_lock while __of_node_is_type() is also called from paths that
>   already hold devtree_lock, such as of_find_node_by_type(),
>   of_match_node(), and of_find_matching_node_and_match()
> - keep the device_type validation bounded, but use __of_get_property()
>   directly so the helper remains safe under devtree_lock
> 
> Changes since v1:
> - rework of_prop_next_string() so the first returned string is validated
>   through the same bounded path
> - add of_unittest_property_string() coverage for malformed first and
>   trailing string-list entries
> 
>  drivers/of/base.c     | 43 ++++++++++++++++-----------
>  drivers/of/property.c | 27 +++++++++++++----
>  drivers/of/unittest.c | 32 ++++++++++++++++++++
>  3 files changed, 80 insertions(+), 22 deletions(-)
> 

Applied, thanks!