lib/bootconfig: increment xbc_node_num after node init succeeds

Browse source

Move the xbc_node_num increment to after xbc_init_node() so a failed
init does not leave a partially initialized node counted in the array.

If xbc_init_node() fails on a data offset at the boundary of a
maximum-size bootconfig, the pre-incremented count causes subsequent
tree verification and traversal to consider the uninitialized node as
valid, potentially leading to an out-of-bounds read or unpredictable
boot behavior.

Link: https://lore.kernel.org/all/20260318155919.78168-5-objecting@objecting.org/

Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

...

This commit is contained in:

Josh Law 2026-03-19 08:43:24 +09:00 • committed by Masami Hiramatsu (Google)

parent 1c04fa8011

commit ae9bf4d383

1 changed files with 2 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

lib/bootconfig.c

View file