Commit f45ab277 authored by Pengpeng Hou's avatar Pengpeng Hou Committed by Juergen Gross
Browse files

ARM: xen: validate hypervisor compatible before parsing its version 



fdt_find_hyper_node() reads the raw compatible property and then derives
hyper_node.version from a prefix match before later printing it with %s.
Flat DT properties are external boot input, and this path does not prove
that the first compatible entry is NUL-terminated within the returned
property length.

Keep the existing flat-DT lookup path, but verify that the first
compatible entry terminates within the returned property length before
deriving the version suffix from it.

Signed-off-by: default avatarPengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Message-ID: <20260405094005.5-arm-xen-v2-pengpeng@iscas.ac.cn>
parent 591cd656

arch/arm/xen/enlighten.c

+6 −4
Original line number Diff line number Diff line
@@ -218,8 +218,9 @@ static __initdata struct { 
static int __init fdt_find_hyper_node(unsigned long node, const char *uname,

				      int depth, void *data)

{

	const void *s = NULL;

	const char *s = NULL;

	int len;

	size_t prefix_len = strlen(hyper_node.prefix);



	if (depth != 1 || strcmp(uname, "hypervisor") != 0)

		return 0;
@@ -228,9 +229,10 @@ static int __init fdt_find_hyper_node(unsigned long node, const char *uname, 
		hyper_node.found = true;



	s = of_get_flat_dt_prop(node, "compatible", &len);

	if (strlen(hyper_node.prefix) + 3  < len &&

	    !strncmp(hyper_node.prefix, s, strlen(hyper_node.prefix)))

		hyper_node.version = s + strlen(hyper_node.prefix);

	if (s && len > 0 && strnlen(s, len) < len &&

	    len > prefix_len + 3 &&

	    !strncmp(hyper_node.prefix, s, prefix_len))

		hyper_node.version = s + prefix_len;



	/*

	 * Check if Xen supports EFI by checking whether there is the