`of_register_slim_devices()` fetches raw `"compatible"` bytes with
`of_get_property()` and then immediately parses them with
`sscanf("slim%x,%x", ...)`.
Live-tree OF properties are stored as raw bytes plus a separate length;
they are not globally guaranteed to be NUL-terminated. Validate the
first compatible string before parsing it.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/slimbus/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c
index ee6318e247d3..d88b397ea81f 100644
--- a/drivers/slimbus/core.c
+++ b/drivers/slimbus/core.c
@@ -209,8 +209,8 @@ static void of_register_slim_devices(struct slim_controller *ctrl)
int reg[2], ret;
int manf_id, prod_code;
- compat = of_get_property(node, "compatible", NULL);
- if (!compat)
+ ret = of_property_read_string(node, "compatible", &compat);
+ if (ret)
continue;
ret = sscanf(compat, "slim%x,%x", &manf_id, &prod_code);
--
2.50.1 (Apple Git-155)