linux-kernel - [PATCH] LoongArch: Avoid in-place string operation on FDT content

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250705125710.59994-1-ziyao@disroot.org>
Date: Sat,  5 Jul 2025 12:57:10 +0000
From: Yao Zi <ziyao@...root.org>
To: Huacai Chen <chenhuacai@...nel.org>,
	WANG Xuerui <kernel@...0n.name>,
	Miaoqian Lin <linmq006@...il.com>,
	Yao Zi <ziyao@...root.org>,
	Hongliang Wang <wanghongliang@...ngson.cn>,
	Binbin Zhou <zhoubinbin@...ngson.cn>,
	Jiaxun Yang <jiaxun.yang@...goat.com>
Cc: loongarch@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Mingcong Bai <jeffbai@...c.io>,
	Kexy Biscuit <kexybiscuit@...c.io>
Subject: [PATCH] LoongArch: Avoid in-place string operation on FDT content

In init_cpu_fullname, a constant pointer to model property is retrieved.
It's later modified by the strsep function, which is illegal and
corrupts kernel's FDT copy. This is shown by dmesg,

	OF: fdt: not creating '/sys/firmware/fdt': CRC check failed

Create a mutable copy of the model property and do in-place operations
on it instead. loongson_sysconf.cpuname lives across the kernel
lifetime, thus manually releasing isn't necessary.

Also move of_node_put() for the root node after the usage of its
property, since of_node_put() decreases the reference counter thus usage
after the call is unsafe.

Fixes: 44a01f1f726a ("LoongArch: Parsing CPU-related information from DTS")
Signed-off-by: Yao Zi <ziyao@...root.org>
---
 arch/loongarch/kernel/env.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/arch/loongarch/kernel/env.c b/arch/loongarch/kernel/env.c
index 27144de5c5fe..fba141472ab9 100644
--- a/arch/loongarch/kernel/env.c
+++ b/arch/loongarch/kernel/env.c
@@ -40,15 +40,18 @@ void __init init_environ(void)
 static int __init init_cpu_fullname(void)
 {
 	struct device_node *root;
+	const char *model;
 	int cpu, ret;
-	char *model;
+	char *tmp;
 
 	/* Parsing cpuname from DTS model property */
 	root = of_find_node_by_path("/");
-	ret = of_property_read_string(root, "model", (const char **)&model);
+	ret = of_property_read_string(root, "model", &model);
+	if (ret == 0) {
+		tmp = kstrdup(model, GFP_KERNEL);
+		loongson_sysconf.cpuname = strsep(&tmp, " ");
+	}
 	of_node_put(root);
-	if (ret == 0)
-		loongson_sysconf.cpuname = strsep(&model, " ");
 
 	if (loongson_sysconf.cpuname && !strncmp(loongson_sysconf.cpuname, "Loongson", 8)) {
 		for (cpu = 0; cpu < NR_CPUS; cpu++)
-- 
2.49.0