On Wed, 4 Nov 2026 15:37:41 +0800, Zhiqi Zhang [off-list ref] wrote:
xbc_verify_tree() accepts keys with XBC_DEPTH_MAX (16) components,
but xbc_node_compose_key_after() returns -ERANGE immediately after
storing the sixteenth component. It rejects the key before discovering
that there are no more ancestors to collect.
For example, a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p = value can be attached
to an initrd successfully. However, bootconfig -l stops listing and
prints "Failed to compose key -34". In the kernel, the same error
propagates through copy_xbc_key_value_list() during its length probe,
so proc_boot_config_init() returns before creating /proc/bootconfig.
Check the array capacity before storing the next component. This lets
exactly XBC_DEPTH_MAX components be composed while retaining the check
before any out-of-bounds store.
Ah, good catch! Let me pick it.
Thank you!
quoted hunk ↗ jump to hunk
I found this issue while reviewing bootconfig's depth handling and used
OpenAI Codex to verify the failure and develop the fix. I reviewed the
change and wrote and ran the regression tests.
Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support")
Cc: <redacted>
Signed-off-by: Zhiqi Zhang <redacted>
---
lib/bootconfig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 819685d6c68d..a4aae9a9abca 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -428,9 +428,9 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
node = xbc_node_get_parent(node);
while (node && node != root) {
- keys[depth++] = xbc_node_index(node);
if (depth == XBC_DEPTH_MAX)
return -ERANGE;
+ keys[depth++] = xbc_node_index(node);
node = xbc_node_get_parent(node);
}
if (!node && root)
--
Masami Hiramatsu (Google) [off-list ref]