Hi Tom, On Sat, 31 Oct 2026 at 08:33, Tom Rini <[email protected]> wrote: > > On Sat, Oct 31, 2026 at 07:05:55AM -0700, Simon Glass wrote: > > Hi Frieder, > > > > On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: > > > bootstd: rauc: Fix overflow of the BOOT_x_LEFT name buffer > > > > > > The name of the BOOT_x_LEFT variable of a slot is written into a stack > > > buffer of BOOT_LEFT_LEN bytes with sprintf(). BOOT_LEFT_LEN leaves room > > > for a slot name of 32 characters, but not for the terminating NUL, and > > > longer names are not limited at all. > > > > > > When booting, the slot names come from BOOT_ORDER in the environment, > > > which is only checked against the configured slots when the bootflow is > > > read. Setting BOOT_ORDER to a long name between 'bootflow scan' and > > > 'bootflow boot' therefore overflows the buffer in find_active_slot(). > > > > > > Make room for the NUL, and write the name with snprintf() in a helper > > > that fails with -E2BIG if it does not fit. > > > > > > Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") > > > Assisted-by: LLM > > > Signed-off-by: Frieder Schrempf <[email protected]> > > > > > > boot/bootmeth_rauc.c | 34 +++++++++++++++++++++++++++------- > > > 1 file changed, 27 insertions(+), 7 deletions(-) > > > > > diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c > > > @@ -167,7 +176,10 @@ static int distro_rauc_read_bootflow(struct udevice > > > *dev, struct bootflow *bflow > > > - sprintf(boot_left, "BOOT_%s_LEFT", > > > default_boot_order_list[i]); > > > + if (boot_left_name(boot_left, default_boot_order_list[i])) { > > > + str_free_list(default_boot_order_list); > > > + return log_msg_ret("env", -E2BIG); > > > + } > > > > This is a build-time configuration error: a slot name longer than 32 > > characters in CONFIG_BOOTMETH_RAUC_BOOT_ORDER now quietly produces no > > bootflow, and the log_msg_ret() output only appears with > > CONFIG_LOG_ERROR_RETURN enabled. Please can you add a log_err() here, > > as you do for the missing partition names in patch 6, and mention the > > 32-character limit in the BOOTMETH_RAUC_BOOT_ORDER help? Also, the > > other callers pass on the helper's return value, so it would be worth > > returning 'ret' rather than repeating -E2BIG here. > > > > Reviewed-by: Simon Glass <[email protected]> > > I've asked you before to not give both substantive changes and a > reviewed-by tag.
I felt it was a grey area - the 32-character limit is large enough that we shouldn't hit it in practice...the error code is very minor. I'll err more on the side of no review tag from now on. Regards, Simon
