[PATCH] lib/bootconfig: guard xbc_node_compose_key_after() buffer size

[PATCH] lib/bootconfig: guard xbc_node_compose_key_after() buffer size

[Josh Law]

xbc_node_compose_key_after() passes a size_t buffer length to
snprintf(), but snprintf() returns int. Guard against size values above
INT_MAX before the loop, then compare the returned length as size_t when
checking for truncation.

Add a small WARN_ON_ONCE shim for the tools/bootconfig userspace build
so the same source continues to build there.

Signed-off-by: Josh Law <objecting@objecting.org>
---
 lib/bootconfig.c                            | 5 ++++-
 tools/bootconfig/include/linux/bootconfig.h | 5 +++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 96cbe6738ffe..bc6751b632e3 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -313,13 +313,16 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
 	if (!node && root)
 		return -EINVAL;
 
+	if (WARN_ON_ONCE(size > INT_MAX))
+		return -EINVAL;
+
 	while (--depth >= 0) {
 		node = xbc_nodes + keys[depth];
 		ret = snprintf(buf, size, "%s%s", xbc_node_get_data(node),
 			       depth ? "." : "");
 		if (ret < 0)
 			return ret;
-		if (ret >= (int)size) {
+		if ((size_t)ret >= size) {
 			size = 0;
 		} else {
 			size -= (size_t)ret;
diff --git a/tools/bootconfig/include/linux/bootconfig.h b/tools/bootconfig/include/linux/bootconfig.h
index 6784296a0692..48383c10e036 100644
--- a/tools/bootconfig/include/linux/bootconfig.h
+++ b/tools/bootconfig/include/linux/bootconfig.h
@@ -8,6 +8,7 @@
 #include <stdbool.h>
 #include <ctype.h>
 #include <errno.h>
+#include <limits.h>
 #include <string.h>
 
 
@@ -19,6 +20,10 @@
 	((cond) ? printf("Internal warning(%s:%d, %s): %s\n",	\
 			__FILE__, __LINE__, __func__, #cond) : 0)
 
+#ifndef WARN_ON_ONCE
+#define WARN_ON_ONCE(cond)	WARN_ON(cond)
+#endif
+
 #define unlikely(cond)	(cond)
 
 /* Copied from lib/string.c */
-- 
2.34.1

Re: [PATCH] lib/bootconfig: guard xbc_node_compose_key_after() buffer size

[Steven Rostedt]

On Tue, 17 Mar 2026 17:37:03 +0000
Josh Law <objecting@objecting.org> wrote:

> @@ -313,13 +313,16 @@ int __init xbc_node_compose_key_after(struct xbc_node *root,
>  	if (!node && root)
>  		return -EINVAL;
>  
> +	if (WARN_ON_ONCE(size > INT_MAX))
> +		return -EINVAL;
> +
>  	while (--depth >= 0) {
>  		node = xbc_nodes + keys[depth];
>  		ret = snprintf(buf, size, "%s%s", xbc_node_get_data(node),
>  			       depth ? "." : "");
>  		if (ret < 0)
>  			return ret;
> -		if (ret >= (int)size) {
> +		if ((size_t)ret >= size) {

Hmm, if size can't be greater than INT_MAX, this code should be able to
stay the same.

-- Steve


>  			size = 0;
>  		} else {
>  			size -= (size_t)ret;