Skip to contentSkip to conversation

lib/bootconfig: three bug fixes

PATCH In review Josh Law 4 participants 19 messages Mar 12 – Mar 13

Subsystems (3)
lore
Share & tools
lore

Josh Law

author
#0 lore raw

v2 cover lib/bootconfig: three bug fixes

Three fixes for lib/bootconfig.c:

1. Fix off-by-one in xbc_verify_tree() unclosed brace error reporting.
2. Check bounds before writing in __xbc_open_brace() to prevent potential out-of-bounds writes.
3. Fix snprintf truncation check in xbc_node_compose_key_after().

Changes since v1:
- Added explicit From: lines at top of changelog.

Josh Law (3):
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace
error
lib/bootconfig: check bounds before writing in __xbc_open_brace() lib/bootconfig: fix snprintf truncation check in
xbc_node_compose_key_after()

 lib/bootconfig.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
Signature · 1 line
2.34.1
author
#1 lore raw

PATCH v2 1/3 lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error

From: Josh Law <[email protected]>

__xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry. xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node.

Use open_brace[brace_index - 1] to correctly identify the unclosed brace. brace_index is known to be > 0 here since we are inside the if (brace_index) guard.

---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index 2bcd5c2aa87e..a1e6a2e14b01 100644
@@ -802,7 +802,7 @@ static int __init xbc_verify_tree(void)
 
 	/* Brace closing */
 	if (brace_index) {
-		n = &xbc_nodes[open_brace[brace_index]];
+		n = &xbc_nodes[open_brace[brace_index - 1]];
 		return xbc_parse_error("Brace is not closed",
 					xbc_node_get_data(n));
 	}
Signature · 1 line
2.34.1
maintainer Reviewed-by on v2 1/3
#2 lore raw

Re: [PATCH v2 1/3] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error

Quoted 9 lines · On Thu, 12 Mar 2026 19:11:41 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

__xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry. xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node.

Quoted 5 lines

Use open_brace[brace_index - 1] to correctly identify the unclosed brace. brace_index is known to be > 0 here since we are inside the if (brace_index) guard.

Nice catch. May I ask how you found this.

-- Steve

Quoted 17 lines
---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index 2bcd5c2aa87e..a1e6a2e14b01 100644
@@ -802,7 +802,7 @@ static int __init xbc_verify_tree(void)
 
 	/* Brace closing */
 	if (brace_index) {
-		n = &xbc_nodes[open_brace[brace_index]];
+		n = &xbc_nodes[open_brace[brace_index - 1]];
 		return xbc_parse_error("Brace is not closed",
 					xbc_node_get_data(n));
 	}
author
#3 lore raw

Re: [PATCH v2 1/3] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error

12 Mar 2026 21:02:51 Steven Rostedt <[email protected]>:

Quoted 34 lines
Quoted 9 lines · On Thu, 12 Mar 2026 19:11:41 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

__xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry.  xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node.

Quoted 5 lines

Use open_brace[brace_index - 1] to correctly identify the unclosed brace.  brace_index is known to be > 0 here since we are inside the if (brace_index) guard.

Nice catch. May I ask how you found this.

-- Steve

Quoted 10 lines

---
lib/bootconfig.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +0 -0
index 2bcd5c2aa87e..a1e6a2e14b01 100644
@@ -802,7 +802,7 @@ static int __init xbc_verify_tree(void)
 
Quoted 7 lines

lib/bootconfig.c static int __init xbc_verify_tree(void) · line 808

Quoted 7 lines
lib/bootconfig.c +1 -1
     /* Brace closing */
     if (brace_index) {
-       n = &xbc_nodes[open_brace[brace_index]];
+       n = &xbc_nodes[open_brace[brace_index - 1]];
         return xbc_parse_error("Brace is not closed",
                     xbc_node_get_data(n));
     }

Hi Steve,
Thanks for the review!
I found this while doing a manual audit of the bootconfig parser's error handling. I noticed that the post-increment in __xbc_open_brace() didn't seem to align with how xbc_verify_tree() was accessing the index. I verified it by intentionally passing a malformed config with an unclosed brace and saw it reporting a 'stale' or incorrect node location

#4 lore raw

Re: [PATCH v2 1/3] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error

Quoted 23 lines · On Thu, 12 Mar 2026 21:03:52 +0000 Josh Law <[email protected]> wrote:

12 Mar 2026 21:02:51 Steven Rostedt <[email protected]>:

Quoted 21 lines
Quoted 9 lines · On Thu, 12 Mar 2026 19:11:41 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

__xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry.  xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node.

Quoted 5 lines

Use open_brace[brace_index - 1] to correctly identify the unclosed brace.  brace_index is known to be > 0 here since we are inside the if (brace_index) guard.

Nice catch. May I ask how you found this.

Thanks for patch and review!

Quoted 13 lines
Quoted 13 lines

-- Steve

Quoted 10 lines

---
lib/bootconfig.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +0 -0
index 2bcd5c2aa87e..a1e6a2e14b01 100644
@@ -802,7 +802,7 @@ static int __init xbc_verify_tree(void)
 
Quoted 11 lines
Quoted 7 lines

lib/bootconfig.c static int __init xbc_verify_tree(void) · line 808

Quoted 7 lines
lib/bootconfig.c +1 -1
     /* Brace closing */
     if (brace_index) {
-       n = &xbc_nodes[open_brace[brace_index]];
+       n = &xbc_nodes[open_brace[brace_index - 1]];
         return xbc_parse_error("Brace is not closed",
                     xbc_node_get_data(n));
     }

Hi Steve,
Thanks for the review!
I found this while doing a manual audit of the bootconfig parser's error handling. I noticed that the post-increment in __xbc_open_brace() didn't seem to align with how xbc_verify_tree() was accessing the index. I verified it by intentionally passing a

malformed config with an unclosed brace and saw it reporting a 'stale' or incorrect node location

Thanks, I confirmed it with below config.

$ cat samples/bad-non-closed-brace.bconf 
foo {
	bar {
		buz
}

This closed the 2nd {, but not close the first one.

Without patch;

$ ./bootconfig samples/bad-non-closed-brace.bconf 
Parse Error: Brace is not closed at 2:2

With this fix;

$ ./bootconfig samples/bad-non-closed-brace.bconf 
Parse Error: Brace is not closed at 1:1

Than you!

Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>
author
#5 lore raw

PATCH v2 2/3 lib/bootconfig: check bounds before writing in __xbc_open_brace()

In reply to Josh Law

From: Josh Law <[email protected]>

The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior.

---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index a1e6a2e14b01..62b4ed7a0ba6 100644
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p)
 static int __init __xbc_open_brace(char *p)
 {
 	/* Push the last key as open brace */
-	open_brace[brace_index++] = xbc_node_index(last_parent);
 	if (brace_index >= XBC_DEPTH_MAX)
 		return xbc_parse_error("Exceed max depth of braces", p);
+	open_brace[brace_index++] = xbc_node_index(last_parent);
 
 	return 0;
 }
Signature · 1 line
2.34.1
maintainer
#6 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

Quoted 10 lines · On Thu, 12 Mar 2026 19:11:42 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior.

This is the only place that increments the index, and the check is >=, which means even if there was just one space left, it would fail.

As there's no other place that updates brace_index, I don't believe this patch is needed. It could even replace the >= with ==.

-- Steve

Quoted 21 lines
---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index a1e6a2e14b01..62b4ed7a0ba6 100644
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p)
 static int __init __xbc_open_brace(char *p)
 {
 	/* Push the last key as open brace */
-	open_brace[brace_index++] = xbc_node_index(last_parent);
 	if (brace_index >= XBC_DEPTH_MAX)
 		return xbc_parse_error("Exceed max depth of braces", p);
+	open_brace[brace_index++] = xbc_node_index(last_parent);
 
 	return 0;
 }
author
#7 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

12 Mar 2026 21:06:31 Steven Rostedt <[email protected]>:

Quoted 42 lines
Quoted 10 lines · On Thu, 12 Mar 2026 19:11:42 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior.

This is the only place that increments the index, and the check is >=, which means even if there was just one space left, it would fail.

As there's no other place that updates brace_index, I don't believe this patch is needed. It could even replace the >= with ==.

-- Steve

Quoted 19 lines

---
lib/bootconfig.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index a1e6a2e14b01..62b4ed7a0ba6 100644
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p)
 static int __init __xbc_open_brace(char *p)
 {
     /* Push the last key as open brace */
-   open_brace[brace_index++] = xbc_node_index(last_parent);
     if (brace_index >= XBC_DEPTH_MAX)
         return xbc_parse_error("Exceed max depth of braces", p);
+   open_brace[brace_index++] = xbc_node_index(last_parent);
 
Quoted 2 lines

lib/bootconfig.c static char *skip_spaces_until_newline(char *p) · line 540

Quoted 2 lines
lib/bootconfig.c +0 -0
     return 0;
 }

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

author
#8 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

12 Mar 2026 21:08:03 Josh Law <[email protected]>:

Quoted 44 lines

12 Mar 2026 21:06:31 Steven Rostedt <[email protected]>:

Quoted 42 lines
Quoted 10 lines · On Thu, 12 Mar 2026 19:11:42 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior.

This is the only place that increments the index, and the check is >=, which means even if there was just one space left, it would fail.

As there's no other place that updates brace_index, I don't believe this patch is needed. It could even replace the >= with ==.

-- Steve

Quoted 19 lines

---
lib/bootconfig.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index a1e6a2e14b01..62b4ed7a0ba6 100644
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p)
 static int __init __xbc_open_brace(char *p)
 {
     /* Push the last key as open brace */
-   open_brace[brace_index++] = xbc_node_index(last_parent);
     if (brace_index >= XBC_DEPTH_MAX)
         return xbc_parse_error("Exceed max depth of braces", p);
+   open_brace[brace_index++] = xbc_node_index(last_parent);
 
Quoted 4 lines
Quoted 2 lines

lib/bootconfig.c static char *skip_spaces_until_newline(char *p) · line 540

Quoted 2 lines
lib/bootconfig.c +0 -0
     return 0;
 }

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

Wait Steve,
Thanks for the look. I see your point that it's currently redundant given the call patterns. It looks like Andrew has already merged this into the -mm tree, likely as a 'belt-and-suspenders' safety measure. I'll keep your feedback in mind for future cleanup, but I'm glad we got the other off-by-one fix in as well!

And in my opinion, merging it is a decent idea.

maintainer
#9 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

Quoted 4 lines · On Thu, 12 Mar 2026 21:09:52 +0000 Josh Law <[email protected]> wrote:
Quoted 1 line

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

Wait Steve,
Thanks for the look. I see your point that it's currently redundant given the call patterns. It looks like Andrew has already merged this into the -mm tree, likely as a 'belt-and-suspenders' safety measure. I'll keep your feedback in mind for future cleanup, but I'm glad we got the other off-by-one fix in as well!

Please wordwrap the emails.

Quoted 1 line

And in my opinion, merging it is a decent idea.

You've changed your position without explaining why?

author
#10 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

12 Mar 2026 21:28:11 Andrew Morton <[email protected]>:

Quoted 12 lines · On Thu, 12 Mar 2026 21:09:52 +0000 Josh Law <[email protected]> wrote:
Quoted 5 lines
Quoted 2 lines

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

Wait Steve,
Thanks for the look. I see your point that it's currently redundant given the call patterns. It looks like Andrew has already merged this into the -mm tree, likely as a 'belt-and-suspenders' safety measure. I'll keep your feedback in mind for future cleanup, but I'm glad we got the other off-by-one fix in as well!

Please wordwrap the emails.

Quoted 1 line

And in my opinion, merging it is a decent idea.

You've changed your position without explaining why?

Sorry, I think it should be merged because it's better to be safe than sorry, I know there is different methods of implementation, but this one still works... I know it's churn (and I'm sorry)

maintainer
#11 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

Quoted 23 lines · On Thu, 12 Mar 2026 21:30:10 +0000 Josh Law <[email protected]> wrote:

12 Mar 2026 21:28:11 Andrew Morton <[email protected]>:

Quoted 20 lines · On Thu, 12 Mar 2026 21:09:52 +0000 Josh Law <[email protected]> wrote:
Quoted 7 lines
Quoted 6 lines

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

Quoted 6 lines

Wait Steve,
Thanks for the look. I see your point that it's currently redundant given the call patterns. It looks like Andrew has already merged this into the -mm tree, likely as a 'belt-and-suspenders' safety measure. I'll keep your feedback in mind for future cleanup, but I'm glad we got the other off-by-one fix in as well!

Please wordwrap the emails.

Quoted 1 line

And in my opinion, merging it is a decent idea.

You've changed your position without explaining why?

/me wraps your email (claws-mail does that nicely ;-)

Quoted 3 lines

Sorry, I think it should be merged because it's better to be safe than sorry, I know there is different methods of implementation, but this one still works... I know it's churn (and I'm sorry)

It's not the only place that does that. And since the value is safe as is, I rather not touch it.

-- Steve

#12 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

In reply to Josh Law
Quoted 9 lines · On Thu, 12 Mar 2026 21:30:10 +0000 Josh Law <[email protected]> wrote:

12 Mar 2026 21:28:11 Andrew Morton <[email protected]>:

Quoted 7 lines · On Thu, 12 Mar 2026 21:09:52 +0000 Josh Law <[email protected]> wrote:
Quoted 5 lines
Quoted 2 lines

That's a fair point, Steve. Given that brace_index isn't touched elsewhere and the current check effectively prevents the overflow, I agree this isn't strictly necessary. I'll drop this patch and stick with the fix for the off-by-one reporting error instead. Thanks for the feedback!

Wait Steve,
Thanks for the look. I see your point that it's currently redundant given the call patterns. It looks like Andrew has already merged this into the -mm tree, likely as a 'belt-and-suspenders' safety measure. I'll keep your feedback in mind for future cleanup, but I'm glad we got the other off-by-one fix in as well!

Quoted 7 lines
Quoted 5 lines

Please wordwrap the emails.

Quoted 1 line

And in my opinion, merging it is a decent idea.

You've changed your position without explaining why?

Sorry, I think it should be merged because it's better to be safe than sorry, I know there is different methods of implementation, but this one still works... I know it's churn (and I'm sorry)

I would like to keep this original >= because it is safer. Andrew, I will pick these patches with my test patch.

Thank you,

Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>
#13 lore raw

Re: [PATCH v2 2/3] lib/bootconfig: check bounds before writing in __xbc_open_brace()

In reply to Josh Law
Quoted 11 lines · On Thu, 12 Mar 2026 19:11:42 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior.

Hmm good catch. This is a kind of specification mistake. If we pass below to the bootconfig tool, currently it fails.
----
key1 {
key2 {
key3 {
key4 {
key5 {
key6 {
key7 {
key8 {
key9 {
key10 {
key11 {
key12 {
key13 {
key14 {
key15 {
key16 {
}}}}}}}}}}}}}}}}
----
But since "open_brace[]" array has 16 entries, it should accept the 16th brace.

Let me add a good and a bad example for this case too.

Thanks,

Quoted 23 lines
---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index a1e6a2e14b01..62b4ed7a0ba6 100644
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p)
 static int __init __xbc_open_brace(char *p)
 {
 	/* Push the last key as open brace */
-	open_brace[brace_index++] = xbc_node_index(last_parent);
 	if (brace_index >= XBC_DEPTH_MAX)
 		return xbc_parse_error("Exceed max depth of braces", p);
+	open_brace[brace_index++] = xbc_node_index(last_parent);
 
 	return 0;
 }
Signature · 1 line
2.34.1
Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>
author
#14 lore raw

PATCH v2 3/3 lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()

In reply to Josh Law

From: Josh Law <[email protected]>

snprintf() returns the number of characters that would have been written excluding the NUL terminator. Output is truncated when the return value is >= the buffer size, not just > the buffer size.

When ret == size, the current code takes the non-truncated path, advancing buf by ret and reducing size to 0. This is wrong because the output was actually truncated (the last character was replaced by NUL). Fix by using >= so the truncation path is taken correctly.

---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index 62b4ed7a0ba6..b0ef1e74e98a 100644
@@ -316,7 +316,7 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
 			       depth ? "." : "");
 		if (ret < 0)
 			return ret;
-		if (ret > size) {
+		if (ret >= size) {
 			size = 0;
 		} else {
 			size -= ret;
Signature · 1 line
2.34.1
maintainer Reviewed-by on v2 3/3
#15 lore raw

Re: [PATCH v2 3/3] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()

Quoted 6 lines · On Thu, 12 Mar 2026 19:11:43 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

snprintf() returns the number of characters that would have been written excluding the NUL terminator. Output is truncated when the return value is >= the buffer size, not just > the buffer size.

Quoted 6 lines

When ret == size, the current code takes the non-truncated path, advancing buf by ret and reducing size to 0. This is wrong because the output was actually truncated (the last character was replaced by NUL). Fix by using >= so the truncation path is taken correctly.

-- Steve

Quoted 17 lines
---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index 62b4ed7a0ba6..b0ef1e74e98a 100644
@@ -316,7 +316,7 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
 			       depth ? "." : "");
 		if (ret < 0)
 			return ret;
-		if (ret > size) {
+		if (ret >= size) {
 			size = 0;
 		} else {
 			size -= ret;
#16 lore raw

Re: [PATCH v2 3/3] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()

In reply to Josh Law
Quoted 11 lines · On Thu, 12 Mar 2026 19:11:43 +0000 Josh Law <[email protected]> wrote:

From: Josh Law <[email protected]>

snprintf() returns the number of characters that would have been written excluding the NUL terminator. Output is truncated when the return value is >= the buffer size, not just > the buffer size.

When ret == size, the current code takes the non-truncated path, advancing buf by ret and reducing size to 0. This is wrong because the output was actually truncated (the last character was replaced by NUL). Fix by using >= so the truncation path is taken correctly.

OK, but this one is a minor issue, because either way, remaining size becomes 0.

		ret = snprintf(buf, size, "%s%s", xbc_node_get_data(node),
			       depth ? "." : "");
		if (ret < 0)
			return ret;
		if (ret > size) {
			size = 0;
		} else {
			size -= ret; // if ret == size, the size becomes 0
			buf += ret;
		}

Anyway, to be clear the correct error case handling, this should be applied.

Thank you!

Quoted 21 lines
---
 lib/bootconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
lib/bootconfig.c +1 -1
index 62b4ed7a0ba6..b0ef1e74e98a 100644
@@ -316,7 +316,7 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
 			       depth ? "." : "");
 		if (ret < 0)
 			return ret;
-		if (ret > size) {
+		if (ret >= size) {
 			size = 0;
 		} else {
 			size -= ret;
Signature · 1 line
2.34.1
Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>
#17 lore raw

PATCH 1/1 bootconfig: Add bootconfig tests about braces

In reply to Josh Law

From: Masami Hiramatsu (Google) <[email protected]>

Add more bootconfig tests for checking the error message of non closing brace and max number of nested braces.

---
 .../bootconfig/samples/bad-non-closed-brace.bconf  |    4 ++++
 tools/bootconfig/samples/bad-over-max-brace.bconf  |   19 +++++++++++++++++++
 .../bootconfig/samples/exp-good-nested-brace.bconf |    1 +
 tools/bootconfig/samples/good-nested-brace.bconf   |   18 ++++++++++++++++++
 tools/bootconfig/test-bootconfig.sh                |    9 +++++++++
 5 files changed, 51 insertions(+)
 create mode 100644 tools/bootconfig/samples/bad-non-closed-brace.bconf
 create mode 100644 tools/bootconfig/samples/bad-over-max-brace.bconf
 create mode 100644 tools/bootconfig/samples/exp-good-nested-brace.bconf
 create mode 100644 tools/bootconfig/samples/good-nested-brace.bconf
tools/bootconfig/samples/bad-non-closed-brace.bconf new file +4 -0
new file mode 100644
index 000000000000..6ed9f3363dde
@@ -0,0 +1,4 @@
+foo {
+ bar {
+   buz
+ }
tools/bootconfig/samples/bad-over-max-brace.bconf new file +19 -0
new file mode 100644
index 000000000000..74b5dc9e21dc
@@ -0,0 +1,19 @@
+key1 {
+key2 {
+key3 {
+key4 {
+key5 {
+key6 {
+key7 {
+key8 {
+key9 {
+key10 {
+key11 {
+key12 {
+key13 {
+key14 {
+key15 {
+key16 {
+key17 {
+}}}}}}}}}}}}}}}}}
+
tools/bootconfig/samples/exp-good-nested-brace.bconf new file +1 -0
new file mode 100644
index 000000000000..19e0f51b4553
@@ -0,0 +1 @@
+key1.key2.key3.key4.key5.key6.key7.key8.key9.key10.key11.key12.key13.key14.key15.key16;
tools/bootconfig/samples/good-nested-brace.bconf new file +18 -0
new file mode 100644
index 000000000000..980d094f296e
@@ -0,0 +1,18 @@
+key1 {
+key2 {
+key3 {
+key4 {
+key5 {
+key6 {
+key7 {
+key8 {
+key9 {
+key10 {
+key11 {
+key12 {
+key13 {
+key14 {
+key15 {
+key16 {
+}}}}}}}}}}}}}}}}
+
tools/bootconfig/test-bootconfig.sh +9 -0
index be9bd18b1d56..fc69f815ce4a 100755
@@ -171,6 +171,15 @@ $BOOTCONF $INITRD > $OUTFILE
 xfail grep -q 'val[[:space:]]' $OUTFILE
 xpass grep -q 'val2[[:space:]]' $OUTFILE
 
+echo "Showing correct line:column of no closing brace"
+cat > $TEMPCONF << EOF
+foo {
+bar {
+}
+EOF
+$BOOTCONF -a $TEMPCONF $INITRD 2> $OUTFILE
+xpass grep -q "1:1" $OUTFILE
+
 echo "=== expected failure cases ==="
 for i in samples/bad-* ; do
   xfail $BOOTCONF -a $i $INITRD
author Acked-by on v1 1/1
#18 lore raw

Re: [PATCH] bootconfig: Add bootconfig tests about braces

13 Mar 2026 04:19:06 Masami Hiramatsu (Google) <[email protected]>:

Quoted 101 lines

From: Masami Hiramatsu (Google) <[email protected]>

Add more bootconfig tests for checking the error message of non closing brace and max number of nested braces.

---
.../bootconfig/samples/bad-non-closed-brace.bconf  |    4 ++++ tools/bootconfig/samples/bad-over-max-brace.bconf  |   19 +++++++++++++++++++ .../bootconfig/samples/exp-good-nested-brace.bconf |    1 + tools/bootconfig/samples/good-nested-brace.bconf   |   18 ++++++++++++++++++ tools/bootconfig/test-bootconfig.sh                |    9 +++++++++

5 files changed, 51 insertions(+)

create mode 100644 tools/bootconfig/samples/bad-non-closed-brace.bconf create mode 100644 tools/bootconfig/samples/bad-over-max-brace.bconf create mode 100644 tools/bootconfig/samples/exp-good-nested-brace.bconf create mode 100644 tools/bootconfig/samples/good-nested-brace.bconf

tools/bootconfig/samples/bad-non-closed-brace.bconf new file +4 -0
new file mode 100644
index 000000000000..6ed9f3363dde
@@ -0,0 +1,4 @@
+foo {
+ bar {
+   buz
+ }
tools/bootconfig/samples/bad-over-max-brace.bconf new file +19 -0
new file mode 100644
index 000000000000..74b5dc9e21dc
@@ -0,0 +1,19 @@
+key1 {
+key2 {
+key3 {
+key4 {
+key5 {
+key6 {
+key7 {
+key8 {
+key9 {
+key10 {
+key11 {
+key12 {
+key13 {
+key14 {
+key15 {
+key16 {
+key17 {
+}}}}}}}}}}}}}}}}}
+
tools/bootconfig/samples/exp-good-nested-brace.bconf new file +1 -0
new file mode 100644
index 000000000000..19e0f51b4553
@@ -0,0 +1 @@
+key1.key2.key3.key4.key5.key6.key7.key8.key9.key10.key11.key12.key13.key14.key15.key16;
tools/bootconfig/samples/good-nested-brace.bconf new file +18 -0
new file mode 100644
index 000000000000..980d094f296e
@@ -0,0 +1,18 @@
+key1 {
+key2 {
+key3 {
+key4 {
+key5 {
+key6 {
+key7 {
+key8 {
+key9 {
+key10 {
+key11 {
+key12 {
+key13 {
+key14 {
+key15 {
+key16 {
+}}}}}}}}}}}}}}}}
+
tools/bootconfig/test-bootconfig.sh +0 -0
index be9bd18b1d56..fc69f815ce4a 100755
@@ -171,6 +171,15 @@ $BOOTCONF $INITRD > $OUTFILE

xfail grep -q 'val[[:space:]]' $OUTFILE
xpass grep -q 'val2[[:space:]]' $OUTFILE

tools/bootconfig/test-bootconfig.sh +9 -0
+echo "Showing correct line:column of no closing brace"
+cat > $TEMPCONF << EOF
+foo {
+bar {
+}
+EOF
+$BOOTCONF -a $TEMPCONF $INITRD 2> $OUTFILE
+xpass grep -q "1:1" $OUTFILE
+
Quoted 3 lines

echo "=== expected failure cases ==="
for i in samples/bad-* ; do
   xfail $BOOTCONF -a $i $INITRD