]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
lib/bootconfig: increment xbc_node_num after node init succeeds
authorJosh Law <objecting@objecting.org>
Wed, 18 Mar 2026 23:43:24 +0000 (08:43 +0900)
committerMasami Hiramatsu (Google) <mhiramat@kernel.org>
Wed, 18 Mar 2026 23:43:24 +0000 (08:43 +0900)
commitae9bf4d3835fb1cd3f79ea74e96e6ab6cfe8f415
treeee643fd544822f896492339ed1db392c233fafd8
parent1c04fa80118cc20a943b9ec5b861a824fa90db1c
lib/bootconfig: increment xbc_node_num after node init succeeds

Move the xbc_node_num increment to after xbc_init_node() so a failed
init does not leave a partially initialized node counted in the array.

If xbc_init_node() fails on a data offset at the boundary of a
maximum-size bootconfig, the pre-incremented count causes subsequent
tree verification and traversal to consider the uninitialized node as
valid, potentially leading to an out-of-bounds read or unpredictable
boot behavior.

Link: https://lore.kernel.org/all/20260318155919.78168-5-objecting@objecting.org/
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
lib/bootconfig.c