On Sun, 9 Nov 2014 00:55:47 -0800
, Kevin Cernekee <cernekee@xxxxxxxxx>
wrote:
> __earlycon_of_table_sentinel.compatible is a char[128], not a pointer, so
> it will never be NULL. Checking it against NULL causes the match loop to
> run past the end of the array, and eventually match a bogus entry, under
> the following conditions:
>
> - Kernel command line specifies "earlycon" with no parameters
> - DT has a stdout-path pointing to a UART node
> - The UART driver doesn't use OF_EARLYCON_DECLARE (or maybe the console
> driver is compiled out)
>
> Fix this by checking to see if match->compatible is a non-empty string.
>
> Signed-off-by: Kevin Cernekee <cernekee@xxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.16+
Applied, thanks. Although a more robust fix would probably to be
checking for the end address of the section. This is a safe fix though,
so I'm picking it up.
g.
> ---
> drivers/of/fdt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
> index d1ffca8..30e97bc 100644
> --- a/drivers/of/fdt.c
> +++ b/drivers/of/fdt.c
> @@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_serial(void)
> if (offset < 0)
> return -ENODEV;
>
> - while (match->compatible) {
> + while (match->compatible[0]) {
> unsigned long addr;
> if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
> match++;
> --
> 2.1.1
>
