[PATCH 0/1] libavb: fix avb_replace() OOM handling

[PATCH 0/1] libavb: fix avb_replace() OOM handling

[Josh Law]

Hi folks,

Since I am a new contributor, I would like to introduce myself first. I
am 15, I am from the UK, and I write C. I am interested in lib/, ARM
devices, and Android.

Enough of the introduction. Let's talk about the patch.

avb_replace() is documented to return NULL on OOM. It already did that
before any output was built, but if a later allocation failed after the
first replacement, it returned the partial buffer instead. The callers
only treat NULL as failure, so they could keep booting with truncated AVB
bootargs.

This patch frees the partial buffer and returns NULL. The existing
callers can then report OOM instead of accepting a shortened result.

Josh Law (1):
  libavb: fix avb_replace() OOM handling

 lib/libavb/avb_util.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

-- 
2.47.3

[PATCH 1/1] libavb: fix avb_replace() OOM handling

[Josh Law]

avb_replace() promises NULL on OOM. Once it had built the first
replacement, a later allocation failure returned that partial buffer.
Callers treat any result as success, so AVB could keep booting with
truncated bootargs.

Free the partial result and return NULL. The existing callers can then
take their OOM path.

Signed-off-by: Josh Law <josh2@disroot.org>
---
 lib/libavb/avb_util.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/libavb/avb_util.c b/lib/libavb/avb_util.c
index 8719ede15a7..9e2e6ea3495 100644
--- a/lib/libavb/avb_util.c
+++ b/lib/libavb/avb_util.c
@@ -272,7 +272,7 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
       num_new = num_before + replace_len + 1;
       ret = avb_malloc(num_new);
       if (ret == NULL) {
-        goto out;
+        goto fail;
       }
       avb_memcpy(ret, str, num_before);
       avb_memcpy(ret + num_before, replace, replace_len);
@@ -283,7 +283,7 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
       num_new = ret_len + num_before + replace_len + 1;
       new_str = avb_malloc(num_new);
       if (new_str == NULL) {
-        goto out;
+        goto fail;
       }
       avb_memcpy(new_str, ret, ret_len);
       avb_memcpy(new_str + ret_len, str, num_before);
@@ -308,7 +308,7 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
     size_t num_new = ret_len + num_remaining + 1;
     char* new_str = avb_malloc(num_new);
     if (new_str == NULL) {
-      goto out;
+      goto fail;
     }
     avb_memcpy(new_str, ret, ret_len);
     avb_memcpy(new_str + ret_len, str_after_last_replace, num_remaining);
@@ -320,6 +320,10 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
 
 out:
   return ret;
+
+fail:
+  avb_free(ret);
+  return NULL;
 }
 
 /* We only support a limited amount of strings in avb_strdupv(). */
-- 
2.47.3

Re: [PATCH 1/1] libavb: fix avb_replace() OOM handling

[Simon Glass]

On 2026-05-21T16:51:21, Josh Law <josh2@disroot.org> wrote:
> libavb: fix avb_replace() OOM handling
>
> avb_replace() promises NULL on OOM. Once it had built the first
> replacement, a later allocation failure returned that partial buffer.
> Callers treat any result as success, so AVB could keep booting with
> truncated bootargs.
>
> Free the partial result and return NULL. The existing callers can then
> take their OOM path.
>
> Signed-off-by: Josh Law <josh2@disroot.org>
>
> lib/libavb/avb_util.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Javier Viguera]

On 5/21/26 18:51, Josh Law wrote:
> Hi folks,
> 
> Since I am a new contributor, I would like to introduce myself first. I
> am 15...
Wow, we have a "Benjamin Button" case here. I seem to remember he was 19 
in the kernel mailing list ... :shrug:

--
Javier Viguera
Digi International Inc.

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Mattijs Korpershoek]

Hi Javier,

On Tue, May 26, 2026 at 14:52, Javier Viguera <javier.viguera@digi.com> wrote:

> On 5/21/26 18:51, Josh Law wrote:
>> Hi folks,
>> 
>> Since I am a new contributor, I would like to introduce myself first. I
>> am 15...
> Wow, we have a "Benjamin Button" case here. I seem to remember he was 19
> in the kernel mailing list ... :shrug:

Thank you for emailing a about this. Your message made me curious so
i've found:
https://lore.kernel.org/lkml/cbd0aafa-bd45-4f4d-a2dd-440473657dba@lucifer.local/

I'm no longer sure now if I should spend time reviewing this patch or
not (because of bot suspicion)

>
> --
> Javier Viguera
> Digi International Inc.

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Josh Law]

On May 26, 2026 2:10:29 PM GMT+01:00, Mattijs Korpershoek
<mkorpershoek@kernel.org> wrote:
>Hi Javier,
>
>On Tue, May 26, 2026 at 14:52, Javier Viguera <javier.viguera@digi.com>
>wrote:
>
>> On 5/21/26 18:51, Josh Law wrote:
>>> Hi folks,
>>> 
>>> Since I am a new contributor, I would like to introduce myself first. I
>>> am 15...
>> Wow, we have a "Benjamin Button" case here. I seem to remember he was 19
>> in the kernel mailing list ... :shrug:
>
>Thank you for emailing a about this. Your message made me curious so
>i've found:
>https://lore.kernel.org/lkml/cbd0aafa-bd45-4f4d-a2dd-440473657dba@lucifer.local/
>
>I'm no longer sure now if I should spend time reviewing this patch or
>not (because of bot suspicion)

Hey Mattijs,

It's entirely your choice if you would like to review this!

If you have any questions, feel free to ask! :)

Any concerns also feel free to make known.

(P.S: Simon did some of the heavy lifting with his tag :) ) 


If you choose not to review this that's fine! 

Thanks for the polite comment, it's appreciated :)
>>
>> --
>> Javier Viguera
>> Digi International Inc.
>

Thanks!

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 856 bytes --]

On Tue, May 26, 2026 at 03:10:29PM +0200, Mattijs Korpershoek wrote:
> Hi Javier,
> 
> On Tue, May 26, 2026 at 14:52, Javier Viguera <javier.viguera@digi.com> wrote:
> 
> > On 5/21/26 18:51, Josh Law wrote:
> >> Hi folks,
> >> 
> >> Since I am a new contributor, I would like to introduce myself first. I
> >> am 15...
> > Wow, we have a "Benjamin Button" case here. I seem to remember he was 19
> > in the kernel mailing list ... :shrug:
> 
> Thank you for emailing a about this. Your message made me curious so
> i've found:
> https://lore.kernel.org/lkml/cbd0aafa-bd45-4f4d-a2dd-440473657dba@lucifer.local/
> 
> I'm no longer sure now if I should spend time reviewing this patch or
> not (because of bot suspicion)

Yes, I've moved to Deferred in patchwork as this is an extremely
disappointing thing to have happened.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Kuan-Wei Chiu]

On Tue, May 26, 2026 at 08:23:33AM -0600, Tom Rini wrote:
> On Tue, May 26, 2026 at 03:10:29PM +0200, Mattijs Korpershoek wrote:
> > Hi Javier,
> > 
> > On Tue, May 26, 2026 at 14:52, Javier Viguera <javier.viguera@digi.com> wrote:
> > 
> > > On 5/21/26 18:51, Josh Law wrote:
> > >> Hi folks,
> > >> 
> > >> Since I am a new contributor, I would like to introduce myself first. I
> > >> am 15...

Claiming to be 15 does deepen my concern, because I clearly remember
seeing Josh claim to be 19 on the lkml about two months ago [1], so
this is clearly a mismatch. If even his age has different versions, it
makes me doubt whether the rest of what he says can be trusted.

I previously had a private conversation with Steven Rostedt regarding
Josh. At the time, Steven felt that Josh was just a young kid that
didn't know any better, but in the end, Steven also gave up and decided
to stop helping him [2].

[1]: https://lore.kernel.org/lkml/043CED5F-7014-4776-824E-07E027B7BDC3@objecting.org/
[2]: https://lore.kernel.org/lkml/20260423083246.4b32a665@gandalf.local.home/

Regards,
Kuan-Wei

> > > Wow, we have a "Benjamin Button" case here. I seem to remember he was 19
> > > in the kernel mailing list ... :shrug:
> > 
> > Thank you for emailing a about this. Your message made me curious so
> > i've found:
> > https://lore.kernel.org/lkml/cbd0aafa-bd45-4f4d-a2dd-440473657dba@lucifer.local/
> > 
> > I'm no longer sure now if I should spend time reviewing this patch or
> > not (because of bot suspicion)
> 
> Yes, I've moved to Deferred in patchwork as this is an extremely
> disappointing thing to have happened.
> 
> -- 
> Tom

Re: [PATCH 0/1] libavb: fix avb_replace() OOM handling

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1314 bytes --]

On Wed, May 27, 2026 at 12:51:21AM +0800, Kuan-Wei Chiu wrote:
> On Tue, May 26, 2026 at 08:23:33AM -0600, Tom Rini wrote:
> > On Tue, May 26, 2026 at 03:10:29PM +0200, Mattijs Korpershoek wrote:
> > > Hi Javier,
> > > 
> > > On Tue, May 26, 2026 at 14:52, Javier Viguera <javier.viguera@digi.com> wrote:
> > > 
> > > > On 5/21/26 18:51, Josh Law wrote:
> > > >> Hi folks,
> > > >> 
> > > >> Since I am a new contributor, I would like to introduce myself first. I
> > > >> am 15...
> 
> Claiming to be 15 does deepen my concern, because I clearly remember
> seeing Josh claim to be 19 on the lkml about two months ago [1], so
> this is clearly a mismatch. If even his age has different versions, it
> makes me doubt whether the rest of what he says can be trusted.
> 
> I previously had a private conversation with Steven Rostedt regarding
> Josh. At the time, Steven felt that Josh was just a young kid that
> didn't know any better, but in the end, Steven also gave up and decided
> to stop helping him [2].
> 
> [1]: https://lore.kernel.org/lkml/043CED5F-7014-4776-824E-07E027B7BDC3@objecting.org/
> [2]: https://lore.kernel.org/lkml/20260423083246.4b32a665@gandalf.local.home/

Thanks for bringing the further background to the rest of the U-Boot
community's attention.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]