diff options
| author | Josh Law <objecting@objecting.org> | 2026-03-19 08:43:24 +0900 |
|---|---|---|
| committer | Masami Hiramatsu (Google) <mhiramat@kernel.org> | 2026-03-19 08:43:24 +0900 |
| commit | ae9bf4d3835fb1cd3f79ea74e96e6ab6cfe8f415 (patch) | |
| tree | ee643fd544822f896492339ed1db392c233fafd8 /rust/kernel/interop/git@git.tavy.me:linux-stable.git | |
| parent | 1c04fa80118cc20a943b9ec5b861a824fa90db1c (diff) | |
lib/bootconfig: increment xbc_node_num after node init succeeds
Move the xbc_node_num increment to after xbc_init_node() so a failed
init does not leave a partially initialized node counted in the array.
If xbc_init_node() fails on a data offset at the boundary of a
maximum-size bootconfig, the pre-incremented count causes subsequent
tree verification and traversal to consider the uninitialized node as
valid, potentially leading to an out-of-bounds read or unpredictable
boot behavior.
Link: https://lore.kernel.org/all/20260318155919.78168-5-objecting@objecting.org/
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Diffstat (limited to 'rust/kernel/interop/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions