Re: [PATCH] of: module: harden a call to request_module

[Rob Herring]

On Mon, Sep 14, 2026 at 03:24:25PM +0300, Dmitriy Okunev wrote:
> In of_request_module(), the string 'str' is built from Device Tree data
> and passed directly to request_module() as a format string.  While the
> Device Tree is generally considered trusted, using externally provided
> data as a format string is fragile and can lead to unintended format
> specifier interpretation. 
> 
> Fix this by using request_module("%s", str) to treat 'str' as a plain
> string argument, not a format string.

'%' is not a legal character in DT node names. Even if someone modified 
a DT to have one, would we even get to this point. Probably unflattening 
or creating sysfs files would fail first.

Rob