From 10d98cb822424a4ed53c06aec25790ca3b540a63 Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Mon, 19 Oct 2026 23:56:37 +0800 Subject: [PATCH 1/6] [components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack overflow --- components/drivers/ofw/fdt.c | 66 ++++++++++++++++++++++++++++++++++-- 1 file changed, 63 insertions(+), 3 deletions(-) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index 91679417f8b4..5ecfac16e455 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -874,13 +874,73 @@ static void system_node_init_flag(struct rt_ofw_node *np) } } +static int fdt_check_depth_limit(void *fdt) +{ + int root_off = fdt_path_offset(fdt, "/"); + + if (root_off < 0) + return -1; + + int max_depth = 0; + int depth = 0; + int node = root_off; + int path[OFW_NODE_MAX_DEPTH]; + + while (1) + { + if (depth > max_depth) + max_depth = depth; + + if (max_depth >= OFW_NODE_MAX_DEPTH) + return max_depth; + + int child = fdt_first_subnode(fdt, node); + + if (child >= 0) + { + path[depth] = node; + node = child; + depth++; + continue; + } + + while (1) + { + + int sibling = fdt_next_subnode(fdt, node); + + if (sibling >= 0) { + node = sibling; + break; + } + + if (depth == 0) + return max_depth; + + depth--; + + node = path[depth]; + } + } +} + rt_err_t rt_fdt_unflatten(void) { rt_err_t err = RT_EOK; if (_fdt) { - _phandle_min = OFW_PHANDLE_MAX; + int max_depth = fdt_check_depth_limit(_fdt); + + if (max_depth < 0 || max_depth >= OFW_NODE_MAX_DEPTH) + { + LOG_E("DTB node depth exceeds limit %d, refuse to unflatten", + OFW_NODE_MAX_DEPTH - 1); + + while(1); + } + + _phandle_min = OFW_PHANDLE_MAX; _phandle_max = OFW_PHANDLE_MIN; ofw_node_root = rt_fdt_unflatten_single(_fdt); @@ -1008,8 +1068,8 @@ static rt_err_t fdt_unflatten_single(struct rt_ofw_node *np, int node_off) node_off = fdt_first_subnode(_fdt, node_off); if (node_off >= 0) - { - parent = np; + { + parent = np; np_stack[depth++] = np; From 152d6b9f0b394727a9b2df472b560db5f28d938a Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 20 Oct 2026 00:29:09 +0800 Subject: [PATCH 2/6] [components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack overflow --- components/drivers/ofw/fdt.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index 5ecfac16e455..f48347b95add 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -897,29 +897,30 @@ static int fdt_check_depth_limit(void *fdt) int child = fdt_first_subnode(fdt, node); if (child >= 0) - { + { path[depth] = node; node = child; depth++; + continue; } while (1) - { + { - int sibling = fdt_next_subnode(fdt, node); + int sibling = fdt_next_subnode(fdt, node); - if (sibling >= 0) { + if (sibling >= 0) + { node = sibling; break; } - if (depth == 0) + if (depth == 0) return max_depth; - depth--; - - node = path[depth]; + depth--; + node = path[depth]; } } } @@ -930,17 +931,17 @@ rt_err_t rt_fdt_unflatten(void) if (_fdt) { - int max_depth = fdt_check_depth_limit(_fdt); + int max_depth = fdt_check_depth_limit(_fdt); - if (max_depth < 0 || max_depth >= OFW_NODE_MAX_DEPTH) + if (max_depth < 0 || max_depth >= OFW_NODE_MAX_DEPTH) { LOG_E("DTB node depth exceeds limit %d, refuse to unflatten", - OFW_NODE_MAX_DEPTH - 1); + OFW_NODE_MAX_DEPTH - 1); - while(1); + while(1); } - _phandle_min = OFW_PHANDLE_MAX; + _phandle_min = OFW_PHANDLE_MAX; _phandle_max = OFW_PHANDLE_MIN; ofw_node_root = rt_fdt_unflatten_single(_fdt); @@ -1069,7 +1070,7 @@ static rt_err_t fdt_unflatten_single(struct rt_ofw_node *np, int node_off) if (node_off >= 0) { - parent = np; + parent = np; np_stack[depth++] = np; From c41b948c060659577dda28dd946748b0789b2fb8 Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 20 Oct 2026 00:29:09 +0800 Subject: [PATCH 3/6] [components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack overflow --- components/drivers/ofw/fdt.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index f48347b95add..08713029282e 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -907,8 +907,7 @@ static int fdt_check_depth_limit(void *fdt) while (1) { - - int sibling = fdt_next_subnode(fdt, node); + int sibling = fdt_next_subnode(fdt, node); if (sibling >= 0) { @@ -931,12 +930,12 @@ rt_err_t rt_fdt_unflatten(void) if (_fdt) { - int max_depth = fdt_check_depth_limit(_fdt); + int max_depth = fdt_check_depth_limit(_fdt); if (max_depth < 0 || max_depth >= OFW_NODE_MAX_DEPTH) { LOG_E("DTB node depth exceeds limit %d, refuse to unflatten", - OFW_NODE_MAX_DEPTH - 1); + OFW_NODE_MAX_DEPTH - 1); while(1); } From 95f9f56545ae55ee951dea5bf6677a17c4935d1b Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 20 Oct 2026 00:29:09 +0800 Subject: [PATCH 4/6] [components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack overflow --- components/drivers/ofw/fdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index 08713029282e..b550918d3d0c 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -1068,7 +1068,7 @@ static rt_err_t fdt_unflatten_single(struct rt_ofw_node *np, int node_off) node_off = fdt_first_subnode(_fdt, node_off); if (node_off >= 0) - { + { parent = np; np_stack[depth++] = np; From cd33336c9ddfd5f20f2eb7d6f19e75bdefaa0b6f Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 20 Oct 2026 15:40:56 +0800 Subject: [PATCH 5/6] [components][ofw]fix: gate depth limit check behind RT_USING_DEBUG --- components/drivers/ofw/fdt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index b550918d3d0c..145feb132a99 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -930,6 +930,7 @@ rt_err_t rt_fdt_unflatten(void) if (_fdt) { +#ifdef RT_USING_DEBUG int max_depth = fdt_check_depth_limit(_fdt); if (max_depth < 0 || max_depth >= OFW_NODE_MAX_DEPTH) @@ -939,6 +940,7 @@ rt_err_t rt_fdt_unflatten(void) while(1); } +#endif _phandle_min = OFW_PHANDLE_MAX; _phandle_max = OFW_PHANDLE_MIN; From 75e0c4e08e918465612c487bf848325c42692d34 Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 20 Oct 2026 15:58:11 +0800 Subject: [PATCH 6/6] [components][ofw]fix: wrap fdt_check_depth_limit definition in RT_USING_DEBUG --- components/drivers/ofw/fdt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/drivers/ofw/fdt.c b/components/drivers/ofw/fdt.c index 145feb132a99..b6b2dcd7ff43 100644 --- a/components/drivers/ofw/fdt.c +++ b/components/drivers/ofw/fdt.c @@ -874,6 +874,7 @@ static void system_node_init_flag(struct rt_ofw_node *np) } } +#ifdef RT_USING_DEBUG static int fdt_check_depth_limit(void *fdt) { int root_off = fdt_path_offset(fdt, "/"); @@ -923,6 +924,7 @@ static int fdt_check_depth_limit(void *fdt) } } } +#endif rt_err_t rt_fdt_unflatten(void) {