Hello, u-boot.
If bootdelaykey, bootstopkey and their corresponding default
configuration strings are all empty, presskey_max evaluates to
zero.
Receiving serial input in this state causes the buffer management
logic to execute with presskey_max == 0, resulting in an unsigned
underflow in the expression:
presskey_max - 1
This can lead to out-of-bounds memory accesses and an apparent
hang during autoboot.
diff --git a/common/autoboot.c b/common/autoboot.c
index 0a59b81ae26..ea5430bb8e1 100644
--- a/common/autoboot.c
+++ b/common/autoboot.c
@@ -184,6 +184,12 @@ static int passwd_abort_key(uint64_t etime)
delaykey[i].str ? delaykey[i].str : "NULL");
}
+ /* No delay/stop strings configured, abort is impossible. */
+ if (presskey_max == 0) {
+ printf("No abort key configured, booting\n");
+ return 0;
+ }
+
/* In order to keep up with incoming data, check timeout only
* when catch up.
*/
---------- Forwarded message ---------
From: Simon Glass <[email protected]>
Date: Wed, Sep 23, 2026 at 1:22 AM
Subject: Re: autoboot.c
To: Mattias Barthel <[email protected]>
Hi Mattias,
Would you please send this email to the U-Boot list and cc me?
Thanks,
Simon
On Tue, 22 Sept 2026 at 00:39, Mattias Barthel <[email protected]>
wrote:
>
> Hello,
>
> I am not sure who to contact regarding the autoboot.c in u-boot.
> Since I could see your name as last commiter along those lines I just
thought I would
> reach out to you.
>
> If bootdelaykey, bootstopkey and their corresponding default
> configuration strings are all empty, presskey_max evaluates to
> zero.
>
> Receiving serial input in this state causes the buffer management
> logic to execute with presskey_max == 0, resulting in an unsigned
> underflow in the expression:
>
> presskey_max - 1
>
> This can lead to out-of-bounds memory accesses and an apparent
> hang during autoboot.
>
>
> I just added this:
>
>
> + /* No delay/stop strings configured, abort is impossible. */
> + if (presskey_max == 0) {
> + printf("No abort key configured, booting\n");
> + return 0;
> + }
> +
>
>
>
> Best regards,
> Mattias
>
> --
> Mattias Barthel
--
Mattias Barthel
