[xen staging-4.20] bootfdt: Fix infinite loop in device_tree_for_each_node()

[patchbot@xxxxxxx]

commit a0c5fde6f7ccae0a2dc93512a66a4bf1c0484414
Author:     Dmytro Prokopchuk1 <dmytro_prokopchuk1@xxxxxxxx>
AuthorDate: Fri Jun 26 07:57:33 2026 +0000
Commit:     Michal Orzel <michal.orzel@xxxxxxx>
CommitDate: Wed Jul 15 09:48:36 2026 +0200

    bootfdt: Fix infinite loop in device_tree_for_each_node()
    
    When a node's depth exceeds DEVICE_TREE_MAX_DEPTH inside the
    device_tree_for_each_node() loop, the code prints a warning and
    executes 'continue;' statement, which jumps to condition check,
    bypassing the iterator update step:
    
        node = fdt_next_node(fdt, node, &depth).
    
    The node and depth are not updated, the loop repeatedly evaluates
    the same too-deep node, causing a hang.
    
    Fix this by wrapping the node processing logic in an 'else' block.
    This ensures the loop update step is executed on every iteration,
    safely skipping deeply nested nodes and doing the traversal.
    
    Fixes: 40f2ea3df2e2 ("xen/arm: pass node to device_tree_for_each_node")
    Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@xxxxxxxx>
    Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>
    Release-Acked-by: Oleskii Kurochko <oleksii.kurochko@xxxxxxxxx>
    (cherry picked from commit 3b717f57dca508f546303dd34067b7b906ba459e)
---
 xen/common/device-tree/bootfdt.c | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/xen/common/device-tree/bootfdt.c b/xen/common/device-tree/bootfdt.c
index 529c91e603..9ce7699833 100644
--- a/xen/common/device-tree/bootfdt.c
+++ b/xen/common/device-tree/bootfdt.c
@@ -250,23 +250,28 @@ int __init device_tree_for_each_node(const void *fdt, int 
node,
         {
             printk("Warning: device tree node `%s' is nested too deep\n",
                    name);
-            continue;
         }
-
-        as = depth > 0 ? address_cells[depth-1] : 
DT_ROOT_NODE_ADDR_CELLS_DEFAULT;
-        ss = depth > 0 ? size_cells[depth-1] : DT_ROOT_NODE_SIZE_CELLS_DEFAULT;
-
-        address_cells[depth] = device_tree_get_u32(fdt, node,
-                                                   "#address-cells", as);
-        size_cells[depth] = device_tree_get_u32(fdt, node,
-                                                "#size-cells", ss);
-
-        /* skip the first node */
-        if ( node != first_node )
+        else
         {
-            ret = func(fdt, node, name, depth, as, ss, data);
-            if ( ret != 0 )
-                return ret;
+            as = depth > 0 ?
+                 address_cells[depth - 1] :
+                 DT_ROOT_NODE_ADDR_CELLS_DEFAULT;
+            ss = depth > 0 ?
+                 size_cells[depth - 1] :
+                 DT_ROOT_NODE_SIZE_CELLS_DEFAULT;
+
+            address_cells[depth] = device_tree_get_u32(fdt, node,
+                                                       "#address-cells", as);
+            size_cells[depth] = device_tree_get_u32(fdt, node,
+                                                    "#size-cells", ss);
+
+            /* skip the first node */
+            if ( node != first_node )
+            {
+                ret = func(fdt, node, name, depth, as, ss, data);
+                if ( ret != 0 )
+                    return ret;
+            }
         }
 
         node = fdt_next_node(fdt, node, &depth);
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.20