tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

lib/bootconfig: increment xbc_node_num after node init succeeds

Move the xbc_node_num increment to after xbc_init_node() so a failed
init does not leave a partially initialized node counted in the array.

If xbc_init_node() fails on a data offset at the boundary of a
maximum-size bootconfig, the pre-incremented count causes subsequent
tree verification and traversal to consider the uninitialized node as
valid, potentially leading to an out-of-bounds read or unpredictable
boot behavior.

Link: https://lore.kernel.org/all/20260318155919.78168-5-objecting@objecting.org/

Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

authored by

Josh Law and committed by
Masami Hiramatsu (Google) ae9bf4d3 1c04fa80

+2 -1
+2 -1
lib/bootconfig.c
··· 429 429 if (xbc_node_num == XBC_NODE_MAX) 430 430 return NULL; 431 431 432 - node = &xbc_nodes[xbc_node_num++]; 432 + node = &xbc_nodes[xbc_node_num]; 433 433 if (xbc_init_node(node, data, flag) < 0) 434 434 return NULL; 435 + xbc_node_num++; 435 436 436 437 return node; 437 438 }