In of_request_module(), the string 'str' is built from Device Tree data
and passed directly to request_module() as a format string.  While the
Device Tree is generally considered trusted, using externally provided
data as a format string is fragile and can lead to unintended format
specifier interpretation. 

Fix this by using request_module("%s", str) to treat 'str' as a plain
string argument, not a format string.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9c829c097f2f1 ("of: device: Support loading a module with OF based modalias")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy@gmail.com>
---
 drivers/of/module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/module.c b/drivers/of/module.c
index 1e735fc130ad..592377603c24 100644
--- a/drivers/of/module.c
+++ b/drivers/of/module.c
@@ -73,7 +73,7 @@ int of_request_module(const struct device_node *np)
 
 	of_modalias(np, str, size);
 	str[size - 1] = '\0';
-	ret = request_module(str);
+	ret = request_module("%s", str);
 	kfree(str);
 
 	return ret;
-- 
2.53.0

On Mon, Sep 14, 2026 at 03:24:25PM +0300, Dmitriy Okunev wrote:
> In of_request_module(), the string 'str' is built from Device Tree data
> and passed directly to request_module() as a format string.  While the
> Device Tree is generally considered trusted, using externally provided
> data as a format string is fragile and can lead to unintended format
> specifier interpretation. 
> 
> Fix this by using request_module("%s", str) to treat 'str' as a plain
> string argument, not a format string.

'%' is not a legal character in DT node names. Even if someone modified 
a DT to have one, would we even get to this point. Probably unflattening 
or creating sysfs files would fail first.

Rob