lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()

snprintf() returns the number of characters that would have been
written excluding the NUL terminator.  Output is truncated when the
return value is >= the buffer size, not just > the buffer size.

When ret == size, the current code takes the non-truncated path,
advancing buf by ret and reducing size to 0.  This is wrong because
the output was actually truncated (the last character was replaced by
NUL).  Fix by using >= so the truncation path is taken correctly.

Link: https://lore.kernel.org/all/20260312191143.28719-4-objecting@objecting.org/
Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 9c3d59fb96ed4cab6d4c2774bcf7fb841ab30bd3..2da049216fe0e2a211244b9ca7fef8d2e9f8ee70 100644 (file)
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -316,7 +316,7 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
                               depth ? "." : "");
                if (ret < 0)
                        return ret;
-               if (ret > size) {
+               if (ret >= size) {
                        size = 0;
                } else {
                        size -= ret;