[PATCH] ARM: devtree: validate compatible strings before dumping them

[Pengpeng Hou]

setup_machine_fdt() dumps the root compatible list on the
unsupported-machine path by walking raw property bytes with strlen() and
early_print("%s"). Flat DT properties are external boot input, and this
path does not prove that the compatible string list is NUL-terminated
within its declared bounds.

Switch the local walk to fdt_stringlist_get() so malformed
unterminated entries are rejected before they are used as C strings.

Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
---
 arch/arm/kernel/devtree.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 3b78966e750a..a9593479305e 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/memblock.h>
+#include <linux/libfdt.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
 #include <linux/of_irq.h>
@@ -207,19 +208,16 @@ const struct machine_desc * __init setup_machine_fdt(void *dt_virt)
 
 	if (!mdesc) {
 		const char *prop;
-		int size;
+		int idx = 0;
 		unsigned long dt_root;
 
 		early_print("\nError: unrecognized/unsupported "
 			    "device tree compatible list:\n[ ");
 
 		dt_root = of_get_flat_dt_root();
-		prop = of_get_flat_dt_prop(dt_root, "compatible", &size);
-		while (size > 0) {
+		while ((prop = fdt_stringlist_get(initial_boot_params, dt_root,
+						  "compatible", idx++, NULL)))
 			early_print("'%s' ", prop);
-			size -= strlen(prop) + 1;
-			prop += strlen(prop) + 1;
-		}
 		early_print("]\n\n");
 
 		dump_machine_table(); /* does not return */
-- 
2.50.1 (Apple Git-155)