Linux-Next discussions
 help / color / mirror / Atom feed
* linux-next: manual merge of the mm-nonmm-unstable tree with the tip-fixes tree
@ 2026-07-02 14:04 Mark Brown
  2026-07-02 17:28 ` Andrew Morton
  0 siblings, 1 reply; 3+ messages in thread
From: Mark Brown @ 2026-07-02 14:04 UTC (permalink / raw)
  To: Andrew Morton
  Cc: Bradley Morgan, Breno Leitao, Linux Kernel Mailing List,
	Linux Next Mailing List, Masami Hiramatsu

[-- Attachment #1: Type: text/plain, Size: 2661 bytes --]

Hi all,

Today's linux-next merge of the mm-nonmm-unstable tree got a conflict in:

  lib/bootconfig.c

between commit:

  dec4d8118c179 ("bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()")

from the tip-fixes tree and commit:

  9f2274451ae6b ("lib/bootconfig: fix undefined behavior involving NULL pointer arithmetic")

from the mm-nonmm-unstable tree which look like two fixes for the same
issue.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined lib/bootconfig.c
index 2ed9ee3dc81c7,c913259c80ce1..0000000000000
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@@ -427,18 -427,11 +427,18 @@@ static char xbc_namebuf[XBC_KEYLEN_MAX
  int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
  {
  	struct xbc_node *knode, *vnode;
 -	char *end = buf ? buf + size : NULL;
  	const char *val, *q;
  	size_t len = 0;
  	int ret;
  
 +	/*
 +	 * Track the running written length rather than advancing @buf, so we
 +	 * never form "buf + size" or "buf += ret" while @buf is NULL (the
 +	 * size-probe call passes buf=NULL, size=0). NULL pointer arithmetic
 +	 * is undefined behavior and trips host UBSan / FORTIFY_SOURCE when
 +	 * this renderer runs at kernel build time. snprintf(NULL, 0, ...)
 +	 * itself is well defined and returns the would-be length.
 +	 */
  	xbc_node_for_each_key_value(root, knode, val) {
  		ret = xbc_node_compose_key_after(root, knode,
  					xbc_namebuf, XBC_KEYLEN_MAX);
@@@ -447,11 -440,12 +447,11 @@@
  
  		vnode = xbc_node_get_child(knode);
  		if (!vnode) {
 -			ret = snprintf(buf, rest(buf, end), "%s ", xbc_namebuf);
 +			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
 +				       "%s ", xbc_namebuf);
  			if (ret < 0)
  				return ret;
  			len += ret;
 -			if (buf)
 -				buf += ret;
  			continue;
  		}
  		xbc_array_for_each_value(vnode, val) {
@@@ -461,11 -455,13 +461,11 @@@
  			 * whitespace.
  			 */
  			q = strpbrk(val, " \t\r\n") ? "\"" : "";
 -			ret = snprintf(buf, rest(buf, end), "%s=%s%s%s ",
 -				       xbc_namebuf, q, val, q);
 +			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
 +				       "%s=%s%s%s ", xbc_namebuf, q, val, q);
  			if (ret < 0)
  				return ret;
  			len += ret;
 -			if (buf)
 -				buf += ret;
  		}
  	}
  

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-03 14:41 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-02 14:04 linux-next: manual merge of the mm-nonmm-unstable tree with the tip-fixes tree Mark Brown
2026-07-02 17:28 ` Andrew Morton
2026-07-03 14:41   ` Masami Hiramatsu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox