From: Abdurrahman Hussain Date: Wed, 5 Aug 2026 20:31:00 +0000 (-0700) Subject: of: fix out-of-bounds read in of_alias_scan() stem parser X-Git-Url: http://git.hungrycats.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f;p=linux of: fix out-of-bounds read in of_alias_scan() stem parser The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first. Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 [Claude Code] Signed-off-by: Abdurrahman Hussain Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai Signed-off-by: Rob Herring (Arm) --- diff --git a/drivers/of/base.c b/drivers/of/base.c index dd7dda0e0a57d..378703dbc11f3 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -1971,7 +1971,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align)) /* walk the alias backwards to extract the id and work out * the 'stem' string */ - while (isdigit(*(end-1)) && end > start) + while (end > start && isdigit(*(end - 1))) end--; len = end - start;