`sdw_of_find_slaves()` fetches raw `"compatible"` bytes with
`of_get_property()` and then immediately parses them with
`sscanf("sdw%01x%04hx%04hx%02hhx", ...)`.

Live-tree OF properties are stored as raw bytes plus a separate length;
they are not globally guaranteed to be NUL-terminated. Validate the
first compatible string before parsing it.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

---
 drivers/soundwire/slave.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c
index f5a3ca3b9dda..025cb138ef6f 100644
--- a/drivers/soundwire/slave.c
+++ b/drivers/soundwire/slave.c
@@ -241,8 +241,8 @@ int sdw_of_find_slaves(struct sdw_bus *bus)
 		struct sdw_slave_id id;
 		const __be32 *addr;
 
-		compat = of_get_property(node, "compatible", NULL);
-		if (!compat)
+		ret = of_property_read_string(node, "compatible", &compat);
+		if (ret)
 			continue;
 
 		ret = sscanf(compat, "sdw%01x%04hx%04hx%02hhx", &sdw_version,
-- 
2.50.1 (Apple Git-155)

On Fri, 03 Apr 2026 14:55:12 +0800, Pengpeng Hou wrote:
> `sdw_of_find_slaves()` fetches raw `"compatible"` bytes with
> `of_get_property()` and then immediately parses them with
> `sscanf("sdw%01x%04hx%04hx%02hhx", ...)`.
> 
> Live-tree OF properties are stored as raw bytes plus a separate length;
> they are not globally guaranteed to be NUL-terminated. Validate the
> first compatible string before parsing it.
> 
> [...]

Applied, thanks!

[1/1] soundwire: validate DT compatible before parsing it
      commit: 45c7bda7b7440183850012153988e40b300f40d0

Best regards,
-- 
~Vinod