[PATCH] lib/bootconfig: guard xbc_node_compose_key_after() buffer size
From: Josh Law <hidden>
Date: 2026-03-17 17:37:14
xbc_node_compose_key_after() passes a size_t buffer length to snprintf(), but snprintf() returns int. Guard against size values above INT_MAX before the loop, then compare the returned length as size_t when checking for truncation. Add a small WARN_ON_ONCE shim for the tools/bootconfig userspace build so the same source continues to build there. Signed-off-by: Josh Law <redacted> --- lib/bootconfig.c | 5 ++++- tools/bootconfig/include/linux/bootconfig.h | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 96cbe6738ffe..bc6751b632e3 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c@@ -313,13 +313,16 @@ int __init xbc_node_compose_key_after(struct xbc_node *root, if (!node && root) return -EINVAL; + if (WARN_ON_ONCE(size > INT_MAX)) + return -EINVAL; + while (--depth >= 0) { node = xbc_nodes + keys[depth]; ret = snprintf(buf, size, "%s%s", xbc_node_get_data(node), depth ? "." : ""); if (ret < 0) return ret; - if (ret >= (int)size) { + if ((size_t)ret >= size) { size = 0; } else { size -= (size_t)ret;
diff --git a/tools/bootconfig/include/linux/bootconfig.h b/tools/bootconfig/include/linux/bootconfig.h
index 6784296a0692..48383c10e036 100644
--- a/tools/bootconfig/include/linux/bootconfig.h
+++ b/tools/bootconfig/include/linux/bootconfig.h@@ -8,6 +8,7 @@ #include <stdbool.h> #include <ctype.h> #include <errno.h> +#include <limits.h> #include <string.h>
@@ -19,6 +20,10 @@ ((cond) ? printf("Internal warning(%s:%d, %s): %s\n", \ __FILE__, __LINE__, __func__, #cond) : 0) +#ifndef WARN_ON_ONCE +#define WARN_ON_ONCE(cond) WARN_ON(cond) +#endif + #define unlikely(cond) (cond) /* Copied from lib/string.c */
--
2.34.1