Hi Mattias, On Wed, 23 Sept 2026 at 01:22, Mattias Barthel <[email protected]> wrote: > > Hello, u-boot. > > If bootdelaykey, bootstopkey and their corresponding default > configuration strings are all empty, presskey_max evaluates to > zero. > > Receiving serial input in this state causes the buffer management > logic to execute with presskey_max == 0, resulting in an unsigned > underflow in the expression: > > presskey_max - 1 > > This can lead to out-of-bounds memory accesses and an apparent > hang during autoboot. > > > > diff --git a/common/autoboot.c b/common/autoboot.c > index 0a59b81ae26..ea5430bb8e1 100644 > --- a/common/autoboot.c > +++ b/common/autoboot.c > @@ -184,6 +184,12 @@ static int passwd_abort_key(uint64_t etime) > delaykey[i].str ? delaykey[i].str : "NULL"); > } > > + /* No delay/stop strings configured, abort is impossible. */ > + if (presskey_max == 0) { > + printf("No abort key configured, booting\n"); > + return 0; > + } > + > /* In order to keep up with incoming data, check timeout only > * when catch up. > */ > > > ---------- Forwarded message --------- > From: Simon Glass <[email protected]> > Date: Wed, Sep 23, 2026 at 1:22 AM > Subject: Re: autoboot.c > To: Mattias Barthel <[email protected]> > > > Hi Mattias, > > Would you please send this email to the U-Boot list and cc me? > > Thanks, > Simon > > On Tue, 22 Sept 2026 at 00:39, Mattias Barthel <[email protected]> > wrote: > > > > Hello, > > > > I am not sure who to contact regarding the autoboot.c in u-boot. > > Since I could see your name as last commiter along those lines I just > > thought I would > > reach out to you. > > > > If bootdelaykey, bootstopkey and their corresponding default > > configuration strings are all empty, presskey_max evaluates to > > zero. > > > > Receiving serial input in this state causes the buffer management > > logic to execute with presskey_max == 0, resulting in an unsigned > > underflow in the expression: > > > > presskey_max - 1 > > > > This can lead to out-of-bounds memory accesses and an apparent > > hang during autoboot. > > > > > > I just added this: > > > > > > + /* No delay/stop strings configured, abort is impossible. */ > > + if (presskey_max == 0) { > > + printf("No abort key configured, booting\n"); > > + return 0; > > + } > > + > >
Can you check which version of U-Boot you are using? It looks like this problem was fixed in this patch from 2021: e088f0c3d87 autoboot: fix illegal memory access when stop key and delay key are empty Regards, Simon
