[PATCH] of: reject alias values that are not NUL-terminated

[PATCH] of: reject alias values that are not NUL-terminated

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

of_alias_resolve() passes the value of an /aliases property straight
to of_find_node_by_path_from() as a C string. Unflattened property
values are copied with their exact length, so a value without a
terminating NUL makes the path lookup read past the end of the
allocation.

Only devicetrees barebox trusts get here.
Still, let's skip such values like libfdt's fdt_get_alias_namelen()
does.

Fixes: 58f3457f4f03 ("of: add devicetree probing support")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 drivers/of/base.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 194888359345..1987f9c8b0ca 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -22,6 +22,7 @@
 #include <linux/clk.h>
 #include <linux/ctype.h>
 #include <linux/err.h>
+#include <linux/string_helpers.h>
 #include <pm_domain.h>
 #include <tee/optee.h>
 
@@ -178,13 +179,18 @@ static void of_alias_add(struct alias_prop *ap, struct device_node *np,
 
 static struct device_node *of_alias_resolve(struct device_node *root, struct property *pp)
 {
+	const char *path = of_property_get_value(pp);
+
 	/* Skip those we do not want to proceed */
 	if (!of_prop_cmp(pp->name, "name") ||
 	    !of_prop_cmp(pp->name, "phandle") ||
 	    !of_prop_cmp(pp->name, "linux,phandle"))
 		return NULL;
 
-	return of_find_node_by_path_from(root, of_property_get_value(pp));
+	if (!path || !string_is_terminated(path, pp->length))
+		return NULL;
+
+	return of_find_node_by_path_from(root, path);
 }
 
 static int of_alias_id_parse(const char *start, int *len)
-- 
2.47.3