Files
linux/lib
Breno Leitao dec4d8118c bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
xbc_snprint_cmdline() is meant to be called twice: first with
buf=NULL, size=0 to probe the rendered length, then with a real
buffer to fill it (the standard snprintf() two-pass pattern). The
probe call makes the function compute "buf + size" (NULL + 0) and,
on every iteration, advance "buf += ret" from that NULL base and
pass the result back into snprintf().

Pointer arithmetic on a NULL pointer is undefined behavior. It is
harmless in the in-kernel callers today, but the follow-up patches
run this same code in the userspace tools/bootconfig parser at kernel
build time, where host UBSan / FORTIFY_SOURCE abort the build.

Track a running written length (size_t) instead of mutating @buf, and
only form "buf + len" when @buf is non-NULL. snprintf(NULL, 0, ...)
is itself well defined and returns the would-be length, so the
two-pass "probe then fill" usage returns identical byte counts.

Link: https://lore.kernel.org/all/20260626-bootconfig_using_tools-v7-1-24ab72139c29@debian.org/

Fixes: 51887d03ac ("bootconfig: init: Allow admin to use bootconfig for kernel command line")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-01 08:08:27 +09:00
..
2025-03-16 22:30:49 -07:00
2025-04-11 17:32:37 -07:00
2026-03-05 22:16:08 -05:00
2021-08-19 09:02:55 +09:00
2023-02-02 22:50:01 -08:00
2023-02-02 22:50:01 -08:00
2021-01-03 20:05:18 -05:00
2021-08-19 09:02:55 +09:00
2024-10-14 16:33:24 -05:00
2026-01-11 06:09:11 -10:00
2026-02-27 16:40:16 +01:00
2021-07-08 11:48:20 -07:00
2021-06-18 11:43:09 +02:00
2026-03-24 13:39:53 -04:00
2025-03-25 10:18:31 -03:00
2026-04-18 00:10:48 -07:00
2024-12-09 13:48:29 -08:00
2025-09-13 16:54:46 -07:00