From be18ad502e5d4f9248e1f020d3e0d55a7b9ea986 Mon Sep 17 00:00:00 2001 From: Oleksii Kurochko Date: Wed, 17 Jun 2026 09:20:51 +0200 Subject: [PATCH] libfdt: fix UBSAN null pointer in fdt_property() fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb..96d4cf5713 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len) ret = fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; }