{"id":2224265,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2224265/?format=json","web_url":"http://patchwork.ozlabs.org/project/sparclinux/patch/20260417075458.31262-1-pengpeng@iscas.ac.cn/","project":{"id":10,"url":"http://patchwork.ozlabs.org/api/1.2/projects/10/?format=json","name":"Linux SPARC Development ","link_name":"sparclinux","list_id":"sparclinux.vger.kernel.org","list_email":"sparclinux@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260417075458.31262-1-pengpeng@iscas.ac.cn>","list_archive_url":null,"date":"2026-04-17T07:54:58","name":"sparc32: prom: check OF console path formatting against the early buffer","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"de81cfe1084611d947240c05e208ced9c550dc26","submitter":{"id":93000,"url":"http://patchwork.ozlabs.org/api/1.2/people/93000/?format=json","name":"Pengpeng Hou","email":"pengpeng@iscas.ac.cn"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/sparclinux/patch/20260417075458.31262-1-pengpeng@iscas.ac.cn/mbox/","series":[{"id":500267,"url":"http://patchwork.ozlabs.org/api/1.2/series/500267/?format=json","web_url":"http://patchwork.ozlabs.org/project/sparclinux/list/?series=500267","date":"2026-04-17T07:54:58","name":"sparc32: prom: check OF console path formatting against the early buffer","version":1,"mbox":"http://patchwork.ozlabs.org/series/500267/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224265/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224265/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","sparclinux@vger.kernel.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","patchwork-incoming@ozlabs.org"],"Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org\n (client-ip=150.107.74.76; helo=mail.ozlabs.org;\n envelope-from=srs0=1ctp=cq=vger.kernel.org=sparclinux+bounces-6720-patchwork-incoming=ozlabs.org@ozlabs.org;\n receiver=patchwork.ozlabs.org)","gandalf.ozlabs.org;\n arc=pass smtp.remote-ip=\"2600:3c15:e001:75::12fc:5321\"\n arc.chain=subspace.kernel.org","gandalf.ozlabs.org;\n dmarc=none (p=none dis=none) header.from=iscas.ac.cn","gandalf.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=sparclinux+bounces-6720-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=159.226.251.25","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=iscas.ac.cn","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=iscas.ac.cn"],"Received":["from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1 raw public key)\n server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxnZW3YKPz1yDF\n\tfor ; Fri, 17 Apr 2026 18:08:34 +1000 (AEST)","from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3])\n\tby gandalf.ozlabs.org (Postfix) with ESMTP id 4fxnZV45W6z4wJR\n\tfor ; Fri, 17 Apr 2026 18:08:34 +1000 (AEST)","by gandalf.ozlabs.org (Postfix)\n\tid 4fxnZV3zBpz4wJW; Fri, 17 Apr 2026 18:08:34 +1000 (AEST)","from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby gandalf.ozlabs.org (Postfix) with ESMTPS id 4fxnZQ74bWz4wJR\n\tfor ; Fri, 17 Apr 2026 18:08:30 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id DCFE6302A08F\n\tfor ; Fri, 17 Apr 2026 07:55:11 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 141C3359A8B;\n\tFri, 17 Apr 2026 07:55:09 +0000 (UTC)","from cstnet.cn (smtp25.cstnet.cn [159.226.251.25])\n\t(using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id DC0072D0C9D;\n\tFri, 17 Apr 2026 07:55:06 +0000 (UTC)","from localhost.localdomain (unknown [111.196.245.116])\n\tby APP-05 (Coremail) with SMTP id zQCowADndwtU5+FpplzYDQ--.226S2;\n\tFri, 17 Apr 2026 15:55:00 +0800 (CST)"],"ARC-Seal":["i=2; a=rsa-sha256; d=ozlabs.org; s=201707; t=1776413314; cv=pass;\n\tb=jNCpX6XpgoLj3er8gJMonKsS4QHAG4Z3NR/3G0lwWAJxh4oJ9ubHTthJxo2iaIeTLX+Z1oUebBNb/VS98A6+BdK/R9svlhhvWKQeCI5oMTxeNngQ1p8c8VezxNPw6MsTiHglhySZ34yjAkueCkb/qHV+8SnwbLNR2SRxJFaf1Vr1QCVGzN2OTjgmOOcFCwHJBRhzBOGHf3+mTbc9o8BfXEG1hXZ6//Hv6G53hMM6yNz36N1lEjgKYvfXzCSvFqSClTeruKgMyIW8GVsynRAoSFxegKe2cBPIaI2QSrL6/Zld4ojqUwjMSclZRGWHrnhGSTQIfy6VOESqBJ4ZT18iEg==","i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776412509; cv=none;\n b=uhQedXIFtDxm/+0t+w48UAEn4cTUgocomiFCcF4g5dDfBkIPzkw8062NE70V7ihtfT/AstHXsBwC/hj//naRpxfX+auJaQtM5bwdEzEYQmsEyJGA5KhyctZF45qyznyQqaSD5mhski0bluSoeqxgWi34lxxDU4wl4mRkckrPr2w="],"ARC-Message-Signature":["i=2; a=rsa-sha256; d=ozlabs.org; s=201707;\n\tt=1776413314; c=relaxed/relaxed;\n\tbh=PzD5gA333x7fubGXZ8tZkdAkSYAbrxbxYMKTm7bjpB8=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=acmEsAIss2ubPZqtLFPt3nznBAdZyP7DOWw+BsC9An0LgA6GfemGD5HkJMuEiwwsTXuQP8EQhJUnygpHQRsd+WLWy73QNpeb+xdVkID9x5ypYUfEbJZGveyaP2+UVJD0Ij6KQlOseNeWl+eFzgdzluhTxW/MEYxG69/orK3p53K7zRtNqlmAM0W96UDNlDpJPzgVqL3UaeHd2EqE3XSXTVHZa2BwubxFjiFB277rkAGWfSqj+J2Jx+mQKFnwMeqiK+A8bGIwkBsSlLmEhNaCkft/ORqa9YVQmDrimDCHzERiDgiEnHjDwUAN9dOHKs6S3Iu8A2ujNl2chFxD02ebWQ==","i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776412509; c=relaxed/simple;\n\tbh=QJWOQg1OEDPm1eMtA9Ud52kmNM1YLJc4TL3itkN150Y=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=iqxtHu5lUc9nimJMkTcVxJlMY7WBWcBtSO3M6F6PmwEyXJEy2aOvnw5UmFVYlYN4G/jODFSIbw+vOlg2eMLFzbfBXjR22O5yVhhnWr+fMUMII8Zfk4M+/m9W6iBdmSMT8x2KCxl5o1Fb4YnFYXmTvjTN4LF0GXkF5xAIK0AlXuc="],"ARC-Authentication-Results":["i=2; gandalf.ozlabs.org;\n dmarc=none (p=none dis=none) header.from=iscas.ac.cn;\n spf=pass (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=sparclinux+bounces-6720-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org) smtp.mailfrom=vger.kernel.org","i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=iscas.ac.cn;\n spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25"],"From":"Pengpeng Hou ","To":"\"David S. Miller\" ,\n\tAndreas Larsson ","Cc":"Thorsten Blum ,\n\tsparclinux@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\tPengpeng Hou ","Subject":"[PATCH] sparc32: prom: check OF console path formatting against the\n early buffer","Date":"Fri, 17 Apr 2026 15:54:58 +0800","Message-ID":"<20260417075458.31262-1-pengpeng@iscas.ac.cn>","X-Mailer":"git-send-email 2.50.1","Precedence":"bulk","X-Mailing-List":"sparclinux@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-CM-TRANSID":"zQCowADndwtU5+FpplzYDQ--.226S2","X-Coremail-Antispam":"1UD129KBjvJXoWxZw4rGr48Kr1DXF48Kw48JFb_yoW5WF4fpr\n\t9xJF13Xr45ZF43WF4avr1kZr9Yva1rJ3W7Kws3tw47uFnxA3y8ua42yw4fZ3yDJFy3Gr1j\n\tya90vFsxGF17AaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUkE14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0\n\trVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02\n\t1l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U\n\tJVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc\n\tCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E\n\t2Ix0cI8IcVAFwI0_JF0_Jw1lYx0Ex4A2jsIE14v26r4j6F4UMcvjeVCFs4IE7xkEbVWUJV\n\tW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lc7CjxVAaw2AFwI0_\n\tJF0_Jw1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67\n\tAKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1DMIIY\n\trxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_JFI_Gr1lIxAIcVC0I7IYx2IY6xkF7I0E14\n\tv26F4j6r4UJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Gr0_\n\tCr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUxcT\n\tPUUUUU=","X-CM-SenderInfo":"pshqw1xhqjqxpvfd2hldfou0/","X-Spam-Status":"No, score=-1.1 required=5.0 tests=ARC_SIGNED,ARC_VALID,\n\tDMARC_MISSING,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,\n\tSPF_HELO_NONE,SPF_PASS autolearn=disabled version=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on gandalf.ozlabs.org"},"content":"of_console_init() allocates a fixed 256-byte buffer for the console path\nand then formats \"%pOF\" into it with sprintf(), optionally appending\n\":a\" or \":b\" with strcat().\n\nThe full OF path is not bounded to fit in that early buffer, so the\nconsole path formatting can overrun the allocation before the buffer is\npublished globally.\n\nUse snprintf()/strlcat() and halt early if the console path does not fit\nin the fixed early allocation.\n\nFixes: c73fcc846c91 (\"[SPARC]: Fix serial console device detection.\")\nFixes: a412c85aa82a (\"sparc: Convert to using %pOF instead of full_name\")\n\nSigned-off-by: Pengpeng Hou \n---\n arch/sparc/kernel/prom_32.c | 65 +++++++++++++++++++++++++------------\n 1 file changed, 45 insertions(+), 20 deletions(-)","diff":"diff --git a/arch/sparc/kernel/prom_32.c b/arch/sparc/kernel/prom_32.c\nindex cd94f1e8d644..7bfede7e64d2 100644\n--- a/arch/sparc/kernel/prom_32.c\n+++ b/arch/sparc/kernel/prom_32.c\n@@ -245,15 +245,23 @@ void __init of_console_init(void)\n \t\tif (!dp) {\n \t\t\tprom_printf(\"Cannot find PROM_V0 console node.\\n\");\n \t\t\tprom_halt();\n-\t\t}\n-\t\tof_console_device = dp;\n+\t\t\t}\n+\t\t\tof_console_device = dp;\n \n-\t\tsprintf(of_console_path, \"%pOF\", dp);\n-\t\tif (!strcmp(type, \"serial\")) {\n-\t\t\tstrcat(of_console_path,\n-\t\t\t (skip ? \":b\" : \":a\"));\n-\t\t}\n-\t\tbreak;\n+\t\t\tif (snprintf(of_console_path, of_console_path_sz,\n+\t\t\t\t \"%pOF\", dp) >= of_console_path_sz) {\n+\t\t\t\tprom_printf(\"PROM_V0 console path is too long.\\n\");\n+\t\t\t\tprom_halt();\n+\t\t\t}\n+\t\t\tif (!strcmp(type, \"serial\")) {\n+\t\t\t\tif (strlcat(of_console_path, skip ? \":b\" : \":a\",\n+\t\t\t\t\t of_console_path_sz) >=\n+\t\t\t\t of_console_path_sz) {\n+\t\t\t\t\tprom_printf(\"PROM_V0 console path options are too long.\\n\");\n+\t\t\t\t\tprom_halt();\n+\t\t\t\t}\n+\t\t\t}\n+\t\t\tbreak;\n \n \tdefault:\n \tcase PROM_V2:\n@@ -279,18 +287,35 @@ void __init of_console_init(void)\n \t\t\tprom_halt();\n \t\t}\n \n-\t\tof_console_device = dp;\n-\n-\t\tif (prom_vers == PROM_V2) {\n-\t\t\tsprintf(of_console_path, \"%pOF\", dp);\n-\t\t\tswitch (*romvec->pv_stdout) {\n-\t\t\tcase PROMDEV_TTYA:\n-\t\t\t\tstrcat(of_console_path, \":a\");\n-\t\t\t\tbreak;\n-\t\t\tcase PROMDEV_TTYB:\n-\t\t\t\tstrcat(of_console_path, \":b\");\n-\t\t\t\tbreak;\n-\t\t\t}\n+\t\t\tof_console_device = dp;\n+\n+\t\t\tif (prom_vers == PROM_V2) {\n+\t\t\t\tif (snprintf(of_console_path, of_console_path_sz,\n+\t\t\t\t\t \"%pOF\", dp) >=\n+\t\t\t\t of_console_path_sz) {\n+\t\t\t\t\tprom_printf(\"PROM_V2 console path is too long.\\n\");\n+\t\t\t\t\tprom_halt();\n+\t\t\t\t}\n+\t\t\t\tswitch (*romvec->pv_stdout) {\n+\t\t\t\tcase PROMDEV_TTYA:\n+\t\t\t\t\tif (strlcat(of_console_path, \":a\",\n+\t\t\t\t\t\t of_console_path_sz) >=\n+\t\t\t\t\t of_console_path_sz) {\n+\t\t\t\t\t\tprom_printf(\"%s\",\n+\t\t\t\t\t\t\t \"PROM_V2 console path options are too long.\\n\");\n+\t\t\t\t\t\tprom_halt();\n+\t\t\t\t\t}\n+\t\t\t\t\tbreak;\n+\t\t\t\tcase PROMDEV_TTYB:\n+\t\t\t\t\tif (strlcat(of_console_path, \":b\",\n+\t\t\t\t\t\t of_console_path_sz) >=\n+\t\t\t\t\t of_console_path_sz) {\n+\t\t\t\t\t\tprom_printf(\"%s\",\n+\t\t\t\t\t\t\t \"PROM_V2 console path options are too long.\\n\");\n+\t\t\t\t\t\tprom_halt();\n+\t\t\t\t\t}\n+\t\t\t\t\tbreak;\n+\t\t\t\t}\n \t\t} else {\n \t\t\tconst char *path;\n \n","prefixes":[]}