The configure_env() function copies root compatible strings into a 32-byte buffer prior to parsing. If a compatible string exceeds this limit, strlcpy() silently truncates it, producing a malformed fdtfile path and a boot failure with no indication of the root cause.
Add explicit truncation checks after both strlcpy() calls and emit a log_warning() with the offending compatible string to make such failures easier to diagnose. Signed-off-by: Vivek Ray <[email protected]> --- arch/arm/mach-snapdragon/board.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c index 829a0109ac7..9324030ae4d 100644 --- a/arch/arm/mach-snapdragon/board.c +++ b/arch/arm/mach-snapdragon/board.c @@ -391,6 +391,7 @@ static void configure_env(void) const char *first_compat, *last_compat; char *tmp; char buf[32] = { 0 }; + int len = 0; /* * Most DTB filenames follow the scheme: qcom/<soc>-[vendor]-<board>.dtb * The vendor is skipped when it's a Qualcomm reference board, or the @@ -417,7 +418,10 @@ static void configure_env(void) return; } - strlcpy(buf, first_compat, sizeof(buf) - 1); + /* A safety check to avoid silent failure due to name truncation */ + len = strlcpy(buf, first_compat, sizeof(buf) - 1); + if (len >= sizeof(buf) - 1) + log_warning("compatible '%s' got truncated, fdtfile name too long\n", first_compat); tmp = buf; /* The Qualcomm reference boards (RBx, HDK, etc) */ @@ -468,7 +472,11 @@ static void configure_env(void) /* Copy the last compat (e.g. "qcom,sdm845") into buf */ memset(buf, 0, sizeof(buf)); - strlcpy(buf, last_compat, sizeof(buf) - 1); + + /* check for name truncation */ + len = strlcpy(buf, last_compat, sizeof(buf) - 1); + if (len >= sizeof(buf) - 1) + log_warning("compatible '%s' got truncated, fdtfile name too long\n", last_compat); tmp = buf; /* strsep() is destructive, it replaces the comma with a \0 */ -- 2.34.1
