[GIT PULL] bootconfig: Fixes for v7.2-rc1

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

Hi Linus,

Bootconfig fixes for v7.2-rc1:

- bootconfig: Fix NULL-pointer arithmetic
  Fix undefined pointer arithmetic in xbc_snprint_cmdline() when probing
  the buffer length with NULL and size 0. Track the written length as a
  size_t instead to prevent build-time UBSan/FORTIFY_SOURCE failures.


Please pull the latest bootconfig-fixes-v7.2-rc1 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
bootconfig-fixes-v7.2-rc1

Tag SHA1: 1884488387bb2dfe529a494cb187a73b58125fb0
Head SHA1: dec4d8118c179b3d12bca7e609054c6011c4f2ce


Breno Leitao (1):
      bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()

----
 lib/bootconfig.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)
---------------------------
commit dec4d8118c179b3d12bca7e609054c6011c4f2ce
Author: Breno Leitao <leitao@debian.org>
Date:   Fri Jun 26 05:50:10 2026 -0700

    bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
    
    xbc_snprint_cmdline() is meant to be called twice: first with
    buf=NULL, size=0 to probe the rendered length, then with a real
    buffer to fill it (the standard snprintf() two-pass pattern). The
    probe call makes the function compute "buf + size" (NULL + 0) and,
    on every iteration, advance "buf += ret" from that NULL base and
    pass the result back into snprintf().
    
    Pointer arithmetic on a NULL pointer is undefined behavior. It is
    harmless in the in-kernel callers today, but the follow-up patches
    run this same code in the userspace tools/bootconfig parser at kernel
    build time, where host UBSan / FORTIFY_SOURCE abort the build.
    
    Track a running written length (size_t) instead of mutating @buf, and
    only form "buf + len" when @buf is non-NULL. snprintf(NULL, 0, ...)
    is itself well defined and returns the would-be length, so the
    two-pass "probe then fill" usage returns identical byte counts.
    
    Link: https://lore.kernel.org/all/20260626-bootconfig_using_tools-v7-1-24ab72139c29@debian.org/
    
    Fixes: 51887d03aca1 ("bootconfig: init: Allow admin to use bootconfig for kernel command line")
    Cc: stable@vger.kernel.org
    Signed-off-by: Breno Leitao <leitao@debian.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index f445b7703fdd..2ed9ee3dc81c 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -427,10 +427,18 @@ static char xbc_namebuf[XBC_KEYLEN_MAX] __initdata;
 int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
 {
 	struct xbc_node *knode, *vnode;
-	char *end = buf + size;
 	const char *val, *q;
+	size_t len = 0;
 	int ret;
 
+	/*
+	 * Track the running written length rather than advancing @buf, so we
+	 * never form "buf + size" or "buf += ret" while @buf is NULL (the
+	 * size-probe call passes buf=NULL, size=0). NULL pointer arithmetic
+	 * is undefined behavior and trips host UBSan / FORTIFY_SOURCE when
+	 * this renderer runs at kernel build time. snprintf(NULL, 0, ...)
+	 * itself is well defined and returns the would-be length.
+	 */
 	xbc_node_for_each_key_value(root, knode, val) {
 		ret = xbc_node_compose_key_after(root, knode,
 					xbc_namebuf, XBC_KEYLEN_MAX);
@@ -439,10 +447,11 @@ int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
 
 		vnode = xbc_node_get_child(knode);
 		if (!vnode) {
-			ret = snprintf(buf, rest(buf, end), "%s ", xbc_namebuf);
+			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
+				       "%s ", xbc_namebuf);
 			if (ret < 0)
 				return ret;
-			buf += ret;
+			len += ret;
 			continue;
 		}
 		xbc_array_for_each_value(vnode, val) {
@@ -452,15 +461,15 @@ int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
 			 * whitespace.
 			 */
 			q = strpbrk(val, " \t\r\n") ? "\"" : "";
-			ret = snprintf(buf, rest(buf, end), "%s=%s%s%s ",
-				       xbc_namebuf, q, val, q);
+			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
+				       "%s=%s%s%s ", xbc_namebuf, q, val, q);
 			if (ret < 0)
 				return ret;
-			buf += ret;
+			len += ret;
 		}
 	}
 
-	return buf - (end - size);
+	return len;
 }
 #undef rest
 

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>