On Tue, 30 Jun 2026 17:47:46 +0000
Bradley Morgan <[email protected]> wrote:
> When xbc_snprint_cmdline() is called during the size-probing phase
> (with buf = NULL and size = 0), the function computes the end pointer
> as 'buf + size' (NULL + 0) and repeatedly advances 'buf' via 'buf += ret'.
>
> Under the C standard, performing pointer arithmetic on a NULL pointer is
> undefined behavior. While harmless inside the kernel, this code is also
> compiled into the userspace host tool 'tools/bootconfig', where host
> compilers with UBSan or FORTIFY_SOURCE enabled abort the build when they
> detect NULL pointer arithmetic.
>
> Fix this by guarding the pointer arithmetic so 'buf' is only advanced when
> non-NULL, and track the running written length in a separate 'len' counter
> for the return value (which cannot be recovered from pointer math when
> 'buf' is NULL). The rest() helper and snprintf call sites are unchanged.
>
> Fixes: 51887d03aca1 ("bootconfig: init: Allow admin to use bootconfig for
> kernel command line")
> Cc: [email protected]
> Assisted-by: GLM:glm-5.2
> Signed-off-by: Bradley Morgan <[email protected]>
Thanks for the fix!
Let me pick this to bootconfig/fixes.
Thank you,
> ---
> lib/bootconfig.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> Changes since v1:
> - Got the big guns out! :) (see Assisted-by).
> - Addressed review from Masami Hiramatsu and Breno Leitao.
>
> diff --git a/lib/bootconfig.c b/lib/bootconfig.c
> index f445b7703fdd..c913259c80ce 100644
> --- a/lib/bootconfig.c
> +++ b/lib/bootconfig.c
> @@ -427,8 +427,9 @@ static char xbc_namebuf[XBC_KEYLEN_MAX] __initdata;
> int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
> {
> struct xbc_node *knode, *vnode;
> - char *end = buf + size;
> + char *end = buf ? buf + size : NULL;
> const char *val, *q;
> + size_t len = 0;
> int ret;
>
> xbc_node_for_each_key_value(root, knode, val) {
> @@ -442,7 +443,9 @@ int __init xbc_snprint_cmdline(char *buf, size_t size,
> struct xbc_node *root)
> ret = snprintf(buf, rest(buf, end), "%s ", xbc_namebuf);
> if (ret < 0)
> return ret;
> - buf += ret;
> + len += ret;
> + if (buf)
> + buf += ret;
> continue;
> }
> xbc_array_for_each_value(vnode, val) {
> @@ -456,11 +459,13 @@ int __init xbc_snprint_cmdline(char *buf, size_t size,
> struct xbc_node *root)
> xbc_namebuf, q, val, q);
> if (ret < 0)
> return ret;
> - buf += ret;
> + len += ret;
> + if (buf)
> + buf += ret;
> }
> }
>
> - return buf - (end - size);
> + return len;
> }
> #undef rest
>
> --
> 2.53.0
>
--
Masami Hiramatsu (Google) <[email protected]>
