fdt_add_subnode_namelen() has a bug if asked to add a subnode to a node which has NOP tags interspersed with its properties. In this case fdt_add_subnode_namelen() will put the new subnode before the first NOP tag, even if there are properties after it, which will result in an invalid blob.

This patch fixes the bug, and adds a testcase for it.

Signed-off-by: David Gibson david@gibson.dropbear.id.au --- libfdt/fdt_rw.c | 2 +- tests/Makefile.tests | 3 +- tests/add_subnode_with_nops.c | 85 +++++++++++++++++++++++++++++++++++++++++ tests/run_tests.sh | 3 + 4 files changed, 91 insertions(+), 2 deletions(-) create mode 100644 tests/add_subnode_with_nops.c

diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c index a1c70ff..ac50195 100644 --- a/libfdt/fdt_rw.c +++ b/libfdt/fdt_rw.c @@ -333,7 +333,7 @@ int fdt_add_subnode_namelen(void *fdt, int parentoffset, do { offset = nextoffset; tag = fdt_next_tag(fdt, offset, &nextoffset); - } while (tag == FDT_PROP); + } while ((tag == FDT_PROP) || (tag == FDT_NOP));

nh = _fdt_offset_ptr_w(fdt, offset); nodelen = sizeof(*nh) + ALIGN(namelen+1, FDT_TAGSIZE) + FDT_TAGSIZE; diff --git a/tests/Makefile.tests b/tests/Makefile.tests index 0f4d342..15a5ebb 100644 --- a/tests/Makefile.tests +++ b/tests/Makefile.tests @@ -10,7 +10,8 @@ LIB_TESTS_L = get_mem_rsv \ move_and_save mangle-layout \ open_pack rw_tree1 set_name setprop del_property del_node \ string_escapes references path-references \ - dtbs_equal_ordered + dtbs_equal_ordered \ + add_subnode_with_nops LIB_TESTS = $(LIB_TESTS_L:%=$(TESTS_PREFIX)%)

LIBTREE_TESTS_L = truncated_property diff --git a/tests/add_subnode_with_nops.c b/tests/add_subnode_with_nops.c new file mode 100644 index 0000000..4fb8f02 --- /dev/null +++ b/tests/add_subnode_with_nops.c @@ -0,0 +1,85 @@ +/* + * libfdt - Flat Device Tree manipulation + * Testcase for fdt_nop_node() + * Copyright (C) 2006 David Gibson, IBM Corporation. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include <ctype.h> +#include <stdint.h> + +#include <fdt.h> +#include <libfdt.h> + +#include "tests.h" +#include "testdata.h" + +#define SPACE 65536 + +#define CHECK(code) \ + { \ + err = (code); \ + if (err) \ + FAIL(#code ": %s", fdt_strerror(err)); \ + } + +#define OFF_CHECK(off, code) \ + { \ + (off) = (code); \ + if (off < 0) \ + FAIL(#code ": %s", fdt_strerror(off)); \ + } + +int main(int argc, char *argv[]) +{ + void *fdt; + int err; + int offset; + + test_init(argc, argv); + + fdt = xmalloc(SPACE); + + CHECK(fdt_create(fdt, SPACE)); + + CHECK(fdt_finish_reservemap(fdt)); + CHECK(fdt_begin_node(fdt, "")); + CHECK(fdt_property_cell(fdt, "prop1", TEST_VALUE_1)); + CHECK(fdt_property_cell(fdt, "prop2", TEST_VALUE_2)); + CHECK(fdt_end_node(fdt)); + CHECK(fdt_finish(fdt)); + + verbose_printf("Built empty tree, totalsize = %d\n", + fdt_totalsize(fdt)); + + CHECK(fdt_open_into(fdt, fdt, SPACE)); + + check_getprop_cell(fdt, 0, "prop1", TEST_VALUE_1); + check_getprop_cell(fdt, 0, "prop2", TEST_VALUE_2); + + CHECK(fdt_nop_property(fdt, 0, "prop1")); + + check_getprop_cell(fdt, 0, "prop2", TEST_VALUE_2); + + OFF_CHECK(offset, fdt_add_subnode(fdt, 0, "subnode")); + + check_getprop_cell(fdt, 0, "prop2", TEST_VALUE_2); + + PASS(); +} diff --git a/tests/run_tests.sh b/tests/run_tests.sh index d04bfbe..02b1fb0 100755 --- a/tests/run_tests.sh +++ b/tests/run_tests.sh @@ -127,6 +127,9 @@ libfdt_tests () {

# Tests for behaviour on various sorts of corrupted trees run_test truncated_property + + # Specific bug tests + run_test add_subnode_with_nops }

dtc_tests () {