commit 9964e3b4f954968406fd49b325c4d1ae86cc6e82
author Pierre-Clément Tosi <ptosi@google.com> Tue Oct 10 10:27:25 2023 +0100
committer Pierre-Clément Tosi <ptosi@google.com> Wed Oct 11 18:35:43 2023 +0100
tree 9605b22063128f38d25d5cc587b5c65eee5a3ec4
parent 8106368cb0a70f327cb2cb411a46eb33cb4bded7

FROMGIT: libfdt: fdt_get_alias_namelen: Validate aliases

Ensure that the alias found matches the device tree specification v0.4:

    Each property of the /aliases node defines an alias. The property
    name specifies the alias name. The property value specifies the full
    path to a node in the devicetree.

This protects against a stack overflow caused by

    fdt_path_offset_namelen(fdt, path, namelen)

calling

    fdt_path_offset(fdt, fdt_get_alias_namelen(fdt, path, namelen))

leading to infinite recursion on DTs with "circular" aliases.

This fix was originally written by Mike McTernan for Android in [1].

[1]: https://android.googlesource.com/platform/external/dtc/+/9308e7f9772bd226fea9925b1fc4d53c127ed4d5

Signed-off-by: Pierre-Clément Tosi <ptosi@google.com>
Acked-by: Mike McTernan <mikemcternan@google.com>
Message-ID: <20231010092725.63h7c45p2fnmj577@google.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

(cherry-picked from commit 79b9e326a162b15ca5758ee214e350f4f7c038fe git://git.kernel.org/pub/scm/utils/dtc/dtc.git main)

Test: N/A
Change-Id: I1e5a89039f6b70c82e17739379d97dbf130036e8

libfdt/fdt_ro.c

diff --git a/libfdt/fdt_ro.c b/libfdt/fdt_ro.c
index c7fc486..f40333b 100644
--- a/libfdt/fdt_ro.c
+++ b/libfdt/fdt_ro.c
@@ -540,7 +540,16 @@
 const char *fdt_get_alias_namelen(const void *fdt,
 				  const char *name, int namelen)
 {
-	return fdt_path_getprop_namelen(fdt, "/aliases", name, namelen, NULL);
+	int len;
+	const char *alias;
+
+	alias = fdt_path_getprop_namelen(fdt, "/aliases", name, namelen, &len);
+
+	if (!can_assume(VALID_DTB) &&
+	    !(alias && len > 0 && alias[len - 1] == '\0' && *alias == '/'))
+		return NULL;
+
+	return alias;
 }
 
 const char *fdt_get_alias(const void *fdt, const char *name)

tests/aliases.dts

diff --git a/tests/aliases.dts b/tests/aliases.dts
index 853479a..03ed675 100644
--- a/tests/aliases.dts
+++ b/tests/aliases.dts
@@ -5,6 +5,10 @@
 	#size-cells = <0>;
 
 	aliases {
+		empty = "";
+		loop = "loop";
+		nonull = [626164];
+		relative = "s1/subsubnode";
 		s1 = &sub1;
 		ss1 = &subsub1;
 		sss1 = &subsubsub1;

tests/get_alias.c

diff --git a/tests/get_alias.c b/tests/get_alias.c
index fb2c38c..d2888d6 100644
--- a/tests/get_alias.c
+++ b/tests/get_alias.c
@@ -21,9 +21,16 @@
 
 	aliaspath = fdt_get_alias(fdt, alias);
 
-	if (path && !aliaspath)
+	if (!path && !aliaspath)
+		return;
+
+	if (!aliaspath)
 		FAIL("fdt_get_alias(%s) failed\n", alias);
 
+	if (!path)
+		FAIL("fdt_get_alias(%s) returned %s instead of NULL",
+		     alias, aliaspath);
+
 	if (strcmp(aliaspath, path) != 0)
 		FAIL("fdt_get_alias(%s) returned %s instead of %s\n",
 		     alias, aliaspath, path);
@@ -36,9 +43,14 @@
 	test_init(argc, argv);
 	fdt = load_blob_arg(argc, argv);
 
+	check_alias(fdt, NULL, "empty");
+	check_alias(fdt, NULL, "nonull");
+	check_alias(fdt, NULL, "relative");
 	check_alias(fdt, "/subnode@1", "s1");
 	check_alias(fdt, "/subnode@1/subsubnode", "ss1");
 	check_alias(fdt, "/subnode@1/subsubnode/subsubsubnode", "sss1");
 
+	check_alias(fdt, NULL, "loop"); // Might trigger a stack overflow
+
 	PASS();
 }