Re: [PATCH v1 3/3] xen/libfdt: fix UBSAN null pointer in fdt_property()

["Orzel, Michal" <michal.orzel@xxxxxxx>]

Hi Oleksii,

We treat libfdt as external library and we don't accept any edits here prior to
first sending a fix to libfdt and then cherry-picking a patch (in fact, afacit
we then do the libfdt version update).

~Michal

On 19-May-26 10:39, Oleksii Kurochko wrote:
> fdt_property() unconditionally calls memcpy(ptr, val, len) even when
> len is zero and val is NULL.  This is a legitimate calling convention
> for adding empty FDT properties such as "interrupt-controller", which
> carry no payload.
> 
> In Xen, memcpy() maps to __builtin_memcpy(). The compiler treats
> __builtin_memcpy as nonnull on its pointer arguments, so UBSAN fires
> before it can observe that len is zero:
>   UBSAN: Undefined behaviour in common/libfdt/fdt_sw.c:333:2
>          null pointer passed as argument 2, declared with nonnull
>          attribute
> 
> Guard the memcpy() with a check on len so it is skipped entirely when
> there is no payload to copy, bringing the code in line with the
> nonnull contract.
> 
> Fixes: f0ea06558068 ("libfdt: add version 1.3.0")
> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
> Reviewed-by: Baptiste Le Duc <baptiste.le-duc@xxxxxxxxxx>
> ---
>  xen/common/libfdt/fdt_sw.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c
> index 4c569ee7eb0d..96d4cf571319 100644
> --- a/xen/common/libfdt/fdt_sw.c
> +++ b/xen/common/libfdt/fdt_sw.c
> @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void 
> *val, int len)
>       ret = fdt_property_placeholder(fdt, name, len, &ptr);
>       if (ret)
>               return ret;
> -     memcpy(ptr, val, len);
> +     if (len)
> +             memcpy(ptr, val, len);
>       return 0;
>  }
>