]> git.hungrycats.org Git - linux/commit
of: fix out-of-bounds read in of_alias_scan() stem parser
authorAbdurrahman Hussain <abdurrahman@nexthop.ai>
Wed, 5 Aug 2026 20:31:00 +0000 (13:31 -0700)
committerRob Herring (Arm) <robh@kernel.org>
Thu, 27 Aug 2026 14:36:05 +0000 (09:36 -0500)
commit5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f
tree3323596b26642fd08d3f4960dbef413dfd51641d
parentfe66c3ff85e85d492673c6dc95c3d624a63e0282
of: fix out-of-bounds read in of_alias_scan() stem parser

The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.

Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
drivers/of/base.c