Skip to content

[components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack flow - #11901

Open
liangzhan5 wants to merge 6 commits into
RT-Thread:masterfrom
liangzhan5:add-depth-check
Open

[components][ofw]fix: add depth limit check for fdt_unflatten to prevent stack flow#11901
liangzhan5 wants to merge 6 commits into
RT-Thread:masterfrom
liangzhan5:add-depth-check

Conversation

@liangzhan5

@liangzhan5 liangzhan5 commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

拉取/合并请求描述：(PR description)

[
related #11879

RT-Thread 的components/drivers/ofw/fdt.c里的函数 fdt_unflatten_single() 使用固定大小栈 np_stack[OFW_NODE_MAX_DEPTH]（默认 64 项）来暂存遍历路径。当外部传入的 DTB 文件节点嵌套深度超过 64 层时，压栈前没有深度检查，导致栈越界写入，引发启动阶段 Data Abort 或崩溃。

我在主线的qemu上复现了这个bug。

你的解决方案是什么 (what is your solution)

在 rt_fdt_unflatten() 真正解平铺之前，增加一个预检查函数 fdt_check_depth_limit()，使用手动栈遍历 DTB（也是为了避免残留树和二次断言的问题），计算最大节点深度。若深度超过安全上限（OFW_NODE_MAX_DEPTH - 1，即 63），则直接挂起并打印错误，不进行后续解平铺，。

请提供验证的bsp和config (provide the config and bsp)

  • BSP:
    rt-thread/bsp/qemu-virt64-aarch64

编译结果：
~/rt-thread/bsp/qemu-virt64-aarch64$ python3 qemu.py -dtb virt_depth_63.dtb
[I/rtdm.ofw] Booting RT-Thread on physical CPU 0x0
[I/rtdm.ofw] Machine model: linux,dummy-virt
...
[I/rtdm.mnt] File system initialization done
hello rt-thread

lza@lza-virtual-machine:~/rt-thread/bsp/qemu-virt64-aarch64$ python3 qemu.py -dtb virt_depth_64.dtb
[I/rtdm.ofw] Booting RT-Thread on physical CPU 0x0
[I/rtdm.ofw] Machine model: linux,dummy-virt
...
[I/mm.memblock] 52 MB memory installed to system page
[E/rtdm.ofw] DTB node depth exceeds limit 63, refuse to unflatten

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 add-depth-check
    Enter PR branch add-depth-check in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 add-depth-check 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the add-depth-check branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/drivers/ofw/fdt.c

📊 Current Review Status (Last Updated: 2026-10-20 16:00 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@CLAassistant

CLAassistant commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@GuEe-GUI

GuEe-GUI commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

运行期检查行不行，发现超了直接退出释放内存，不然我觉得花点时间先去检查不太划算

@liangzhan5

liangzhan5 commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

运行期检查行不行，发现超了直接退出释放内存，不然我觉得花点时间先去检查不太划算

谢谢review。

感觉对不完整的树释放内存要手动实现（沿着指针递归遍历），很复杂，它这个内存分配零零散散的，然后还在很多次循环里，怕漏了或者说double free。还有运行期检查后退出可能错误路径处理比较麻烦。

这个check函数没有涉及内存分配或解析属性什么的，只读，跟unflatten本身开销比很小了。

@GuEe-GUI

GuEe-GUI commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

因为 OFW 其实设计支持是偏“信任”固件的，64 层其实已经远远超出了大部分 SoC 的设备树需求，是否可以在 DEBUG 模式才启用这块代码？

@liangzhan5

liangzhan5 commented Oct 20, 2026

Copy link
Copy Markdown
Author

因为 OFW 其实设计支持是偏“信任”固件的，64 层其实已经远远超出了大部分 SoC 的设备树需求，是否可以在 DEBUG 模式才启用这块代码？

agree我推进一下

@liangzhan5

liangzhan5 commented Oct 20, 2026

Copy link
Copy Markdown
Author

因为 OFW 其实设计支持是偏“信任”固件的，64 层其实已经远远超出了大部分 SoC 的设备树需求，是否可以在 DEBUG 模式才启用这块代码？

agree我推进一下

rt-thread/bsp/qemu-virt64-aarch64
开启RT_USING_DEBUG：
python3 qemu.py -dtb virt_depth_65.dtb
[I/rtdm.ofw] Booting RT-Thread on physical CPU 0x0
...
[I/mm.memblock] 52 MB memory installed to system page
[E/rtdm.ofw] DTB node depth exceeds limit 63, refuse to unflatten

关闭RT_USING_DEBUG：
python3 qemu.py -dtb virt_depth_65.dtb

exception info:
esr.EC :0x25
...
X28:0x0000000000000000 X29:0x0000000040195c10 X30:0x00000000400ddba4
SP_EL0:0x0000000000000000
SPSR :0x00000000200003c5
EPC :0x00000000400ddb80
thread cpu bind pri status sp stack size max used left tick error tcb addr usage

please use: addr2line -e rtthread.elf -a -f
0x400ddb80 0x400ddd08 0x400dd70c 0x400a8c60 0x400aeab8 0x401261f8 0x401261dc

@GuEe-GUI

GuEe-GUI commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

可以了，不过RT_USING_DEBUG最好也包下fdt_check_depth_limit，不然可能报警告

@liangzhan5

liangzhan5 commented Oct 20, 2026

Copy link
Copy Markdown
Author

可以了，不过RT_USING_DEBUG最好也包下fdt_check_depth_limit，不然可能报警告

好的我再改改

@liangzhan5

liangzhan5 commented Oct 20, 2026

Copy link
Copy Markdown
Author

可以了，不过RT_USING_DEBUG最好也包下fdt_check_depth_limit，不然可能报警告

改好了

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component: drivers/ofw component: drivers Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@liangzhan5 @CLAassistant @GuEe-GUI