of: fix out-of-bounds read in of_alias_scan() stem parser

The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.

Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

diff --git a/drivers/of/base.c b/drivers/of/base.c
index dd7dda0e0a57d038e54dd24ee23cb1d40f229122..378703dbc11f31c6b0d91dac21a8d4d4ce95dd22 100644 (file)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1971,7 +1971,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
 
                /* walk the alias backwards to extract the id and work out
                 * the 'stem' string */
-               while (isdigit(*(end-1)) && end > start)
+               while (end > start && isdigit(*(end - 1)))
                        end--;
                len = end - start;