Hi Vivek, On 10/06/2026 11:37, Vivek Ray wrote: > The configure_env() function copies root compatible strings into a > 32-byte buffer prior to parsing. If a compatible string exceeds this > limit, strlcpy() silently truncates it, producing a malformed fdtfile > path and a boot failure with no indication of the root cause. > > Add explicit truncation checks after both strlcpy() calls and emit a > log_warning() with the offending compatible string to make such > failures easier to diagnose.
Thanks for the patch! Is there a particular board you ran into this issue with? If the buffer is too small for some boards then we should definitely increase it, could you bump it up to 128? > > Signed-off-by: Vivek Ray <[email protected]> > --- > arch/arm/mach-snapdragon/board.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/arch/arm/mach-snapdragon/board.c > b/arch/arm/mach-snapdragon/board.c > index 829a0109ac7..9324030ae4d 100644 > --- a/arch/arm/mach-snapdragon/board.c > +++ b/arch/arm/mach-snapdragon/board.c > @@ -391,6 +391,7 @@ static void configure_env(void) > const char *first_compat, *last_compat; > char *tmp; > char buf[32] = { 0 }; > + int len = 0; > /* > * Most DTB filenames follow the scheme: qcom/<soc>-[vendor]-<board>.dtb > * The vendor is skipped when it's a Qualcomm reference board, or the > @@ -417,7 +418,10 @@ static void configure_env(void) > return; > } > > - strlcpy(buf, first_compat, sizeof(buf) - 1); > + /* A safety check to avoid silent failure due to name truncation */ > + len = strlcpy(buf, first_compat, sizeof(buf) - 1); > + if (len >= sizeof(buf) - 1) I think there's an off by 1 here, this should just be > not >=, and the same below. Kind regards, > + log_warning("compatible '%s' got truncated, fdtfile name too > long\n", first_compat); > tmp = buf; > > /* The Qualcomm reference boards (RBx, HDK, etc) */ > @@ -468,7 +472,11 @@ static void configure_env(void) > > /* Copy the last compat (e.g. "qcom,sdm845") into buf */ > memset(buf, 0, sizeof(buf)); > - strlcpy(buf, last_compat, sizeof(buf) - 1); > + > + /* check for name truncation */ > + len = strlcpy(buf, last_compat, sizeof(buf) - 1); > + if (len >= sizeof(buf) - 1) > + log_warning("compatible '%s' got truncated, fdtfile > name too long\n", last_compat); > tmp = buf; > > /* strsep() is destructive, it replaces the comma with a \0 */ -- // Casey (she/her)
