[PATCH v2025.09.y 56/58] of: fdt: refuse / in property and node names

[Ahmad Fatoum]

/ is used as delimiter between nodes, so seeing it in a device node name
hints at something fishy going on, so refuse that outright.

Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
Link: https://lore.barebox.org/barebox/177340042002.206359.73330334326620046.b4-ty@pengutronix.de
---
 drivers/of/fdt.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2ef7658bc4ab..8418549a4005 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -67,6 +67,14 @@ static inline bool is_reserved_name(const char *name)
 	return *name == '$';
 }
 
+static inline bool is_allowed_input_name(const char *name)
+{
+	/* We are stricter on input than on output, because we assume barebox
+	 * code won't attempt naming nodes bogously.
+	 */
+	return !is_reserved_name(name) && !strchr(name, '/');
+}
+
 static int of_reservemap_num_entries(const struct fdt_header *fdt)
 {
 	/*
@@ -248,7 +256,7 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 				node = root;
 			} else {
 				/* Only the root node may have an empty name */
-				if (!*pathp || is_reserved_name(pathp)) {
+				if (!*pathp || !is_allowed_input_name(pathp)) {
 					ret = -EINVAL;
 					goto err;
 				}
@@ -285,7 +293,7 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			nodep = fdt_prop->data;
 
 			name = dt_string(&f, dt_strings, fdt32_to_cpu(fdt_prop->nameoff));
-			if (!name || !node ||  is_reserved_name(name)) {
+			if (!name || !node ||  !is_allowed_input_name(name)) {
 				ret = -ESPIPE;
 				goto err;
 			}
-- 
2.47.3