[PATCH] riscv: pi: validate early FDT string properties before string use

[Pengpeng Hou]

The early RISC-V FDT parser reads status, riscv,isa, and mmu-type
directly from the DTB and then passes them to strcmp() or
isa_string_contains(), which in turn uses strlen() and other C string
helpers. DT string properties come from external firmware input and are
not locally proven to be NUL-terminated within the property bounds.

Use fdt_stringlist_get() before treating these properties as C strings
so malformed unterminated properties are rejected instead of being read
past their declared length.

Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
---
 arch/riscv/kernel/pi/fdt_early.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/arch/riscv/kernel/pi/fdt_early.c b/arch/riscv/kernel/pi/fdt_early.c
index a12ff8090f19..a44afd460d70 100644
--- a/arch/riscv/kernel/pi/fdt_early.c
+++ b/arch/riscv/kernel/pi/fdt_early.c
@@ -38,16 +38,13 @@ u64 get_kaslr_seed(uintptr_t dtb_pa)
 static bool fdt_device_is_available(const void *fdt, int node)
 {
 	const char *status;
-	int statlen;
 
-	status = fdt_getprop(fdt, node, "status", &statlen);
+	status = fdt_stringlist_get(fdt, node, "status", 0, NULL);
 	if (!status)
 		return true;
 
-	if (statlen > 0) {
-		if (!strcmp(status, "okay") || !strcmp(status, "ok"))
-			return true;
-	}
+	if (!strcmp(status, "okay") || !strcmp(status, "ok"))
+		return true;
 
 	return false;
 }
@@ -137,14 +134,14 @@ static bool isa_string_contains(const char *isa_str, const char *ext_name)
  */
 static bool early_cpu_isa_ext_available(const void *fdt, int node, const char *ext_name)
 {
-	const void *prop;
+	const char *prop;
 	int len;
 
 	prop = fdt_getprop(fdt, node, "riscv,isa-extensions", &len);
 	if (prop && fdt_stringlist_contains(prop, len, ext_name))
 		return true;
 
-	prop = fdt_getprop(fdt, node, "riscv,isa", &len);
+	prop = fdt_stringlist_get(fdt, node, "riscv,isa", 0, &len);
 	if (prop && isa_string_contains(prop, ext_name))
 		return true;
 
@@ -210,7 +207,7 @@ u64 set_satp_mode_from_fdt(uintptr_t dtb_pa)
 		if (!fdt_device_is_available(fdt, node))
 			continue;
 
-		mmu_type = fdt_getprop(fdt, node, "mmu-type", NULL);
+		mmu_type = fdt_stringlist_get(fdt, node, "mmu-type", 0, NULL);
 		if (!mmu_type)
 			break;
 
-- 
2.50.1 (Apple Git-155)