tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

lib/bootconfig: fix off-by-one in xbc_verify_tree() next node check

Valid node indices are 0 to xbc_node_num-1, so a next value equal to
xbc_node_num is out of bounds. Use >= instead of > to catch this.

A malformed or corrupt bootconfig could pass tree verification with
an out-of-bounds next index. On subsequent tree traversal at boot
time, xbc_node_get_next() would return a pointer past the allocated
xbc_nodes array, causing an out-of-bounds read of kernel memory.

Link: https://lore.kernel.org/all/20260318155919.78168-4-objecting@objecting.org/

Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

authored by

Josh Law and committed by
Masami Hiramatsu (Google) 1c04fa80 bf45f7c5

+1 -1
+1 -1
lib/bootconfig.c
··· 817 817 } 818 818 819 819 for (i = 0; i < xbc_node_num; i++) { 820 - if (xbc_nodes[i].next > xbc_node_num) { 820 + if (xbc_nodes[i].next >= xbc_node_num) { 821 821 return xbc_parse_error("No closing brace", 822 822 xbc_node_get_data(xbc_nodes + i)); 823 823 }