Hi Naveen,
On 2026-09-01T10:24:03, Naveen Kumar Chaudhary <[email protected]> wrote:
> bootstage: guard against NULL record names during relocation/sizing
>
> Bootstage records may legitimately have a NULL name (for example an id
> turned into an accumulator via bootstage_accum() without a preceding
> bootstage_start(), whose record is zero-initialised). bootstage_relocate()
> called strcpy() on rec->name and bootstage_get_size() called strlen() on
> it directly, both dereferencing NULL and crashing during relocation.
>
> Skip records with no name in both functions. They are handled identically
> so the size reported by bootstage_get_size(true) still matches the bytes
> written by bootstage_relocate().
>
> Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
>
> common/bootstage.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/common/bootstage.c b/common/bootstage.c
> @@ -75,6 +75,8 @@ int bootstage_relocate(void *to)
> for (i = 0; i < data->rec_count; i++) {
> const char *from = data->record[i].name;
>
> + if (!from)
> + continue;
> strcpy(ptr, from);
> data->record[i].name = ptr;
> ptr += strlen(ptr) + 1;
Note that I fixed this in my tree[1] - my fix routes both
bootstage_relocate() and bootstage_get_size() through
get_record_name(), which synthesises a name for accumulator records (a
decimal id) rather than dropping them. Silently skipping the record
means it survives relocation without a name and later readers (report,
stash, show) see a NULL where they used to see the generated string,
which is a regression. It also leaves accumulator ids anonymous in
bootstage_report() after relocation.
> diff --git a/common/bootstage.c b/common/bootstage.c
> @@ -523,7 +525,8 @@ int bootstage_get_size(bool add_strings)
> int i;
>
> for (rec = data->record, i = 0; i < data->rec_count; i++, rec++)
> - size += strlen(rec->name) + 1;
> + if (rec->name)
> + size += strlen(rec->name) + 1;
> }
I also suggest adding a 'size' parameter so relocation cannot exceed
what was reserved.
Regards,
Simon
[1]
https://concept.deinde.dev/u-boot/u-boot/-/commit/d109c45267e1ce953aec3dc3980761f8ea6bcecf
