linux-kernel - Re: [PATCH] LoongArch: Avoid in-place string operation on FDT content

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAAhV-H6QFUSRQsLRsR7HvB658qefcv64QyGUsTu_5p5hiW5KwQ@mail.gmail.com>
Date: Tue, 8 Jul 2025 20:37:56 +0800
From: Huacai Chen <chenhuacai@...nel.org>
To: Jiaxun Yang <jiaxun.yang@...goat.com>
Cc: Yao Zi <ziyao@...root.org>, Xuerui Wang <kernel@...0n.name>, 
	Miaoqian Lin <linmq006@...il.com>, Hongliang Wang <wanghongliang@...ngson.cn>, 
	Binbin Zhou <zhoubinbin@...ngson.cn>, loongarch@...ts.linux.dev, 
	linux-kernel@...r.kernel.org, Mingcong Bai <jeffbai@...c.io>, 
	Kexy Biscuit <kexybiscuit@...c.io>
Subject: Re: [PATCH] LoongArch: Avoid in-place string operation on FDT content

Applied, thanks.

Huacai

On Sat, Jul 5, 2025 at 10:06 PM Jiaxun Yang <jiaxun.yang@...goat.com> wrote:
>
>
>
> 在2025年7月5日周六 下午1:57，Yao Zi写道：
> > In init_cpu_fullname, a constant pointer to model property is retrieved.
> > It's later modified by the strsep function, which is illegal and
> > corrupts kernel's FDT copy. This is shown by dmesg,
> >
> >       OF: fdt: not creating '/sys/firmware/fdt': CRC check failed
> >
> > Create a mutable copy of the model property and do in-place operations
> > on it instead. loongson_sysconf.cpuname lives across the kernel
> > lifetime, thus manually releasing isn't necessary.
> >
> > Also move of_node_put() for the root node after the usage of its
> > property, since of_node_put() decreases the reference counter thus usage
> > after the call is unsafe.
> >
> > Fixes: 44a01f1f726a ("LoongArch: Parsing CPU-related information from DTS")
>
> Reviewed-by: Jiaxun Yang <jiaxun.yang@...goat.com>
>
> > Signed-off-by: Yao Zi <ziyao@...root.org>
> > ---
> >  arch/loongarch/kernel/env.c | 11 +++++++----
> >  1 file changed, 7 insertions(+), 4 deletions(-)
> >
> > diff --git a/arch/loongarch/kernel/env.c b/arch/loongarch/kernel/env.c
> > index 27144de5c5fe..fba141472ab9 100644
> > --- a/arch/loongarch/kernel/env.c
> > +++ b/arch/loongarch/kernel/env.c
> > @@ -40,15 +40,18 @@ void __init init_environ(void)
> >  static int __init init_cpu_fullname(void)
> >  {
> >       struct device_node *root;
> > +     const char *model;
> >       int cpu, ret;
> > -     char *model;
> > +     char *tmp;
> >
> >       /* Parsing cpuname from DTS model property */
> >       root = of_find_node_by_path("/");
> > -     ret = of_property_read_string(root, "model", (const char **)&model);
> > +     ret = of_property_read_string(root, "model", &model);
> > +     if (ret == 0) {
> > +             tmp = kstrdup(model, GFP_KERNEL);
> > +             loongson_sysconf.cpuname = strsep(&tmp, " ");
> > +     }
> >       of_node_put(root);
> > -     if (ret == 0)
> > -             loongson_sysconf.cpuname = strsep(&model, " ");
> >
> >       if (loongson_sysconf.cpuname && !strncmp(loongson_sysconf.cpuname,
> > "Loongson", 8)) {
> >               for (cpu = 0; cpu < NR_CPUS; cpu++)
> > --
> > 2.49.0
>
> --
> - Jiaxun