]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
lib/bootconfig: check bounds before writing in __xbc_open_brace()
authorJosh Law <objecting@objecting.org>
Thu, 12 Mar 2026 19:11:42 +0000 (19:11 +0000)
committerMasami Hiramatsu (Google) <mhiramat@kernel.org>
Fri, 13 Mar 2026 08:46:09 +0000 (17:46 +0900)
commit560f763baa0f2c9a44da4294c06af071405ac46f
tree01b8b6603e0d7e9f70223b00992acea28c042ce5
parent39ebc8d7f561e1b64eca87353ef9b18e2825e591
lib/bootconfig: check bounds before writing in __xbc_open_brace()

The bounds check for brace_index happens after the array write.
While the current call pattern prevents an actual out-of-bounds
access (the previous call would have returned an error), the
write-before-check pattern is fragile and would become a real
out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is
self-contained and safe regardless of caller behavior.

Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/
Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
lib/bootconfig.c