Re: [PATCH] arm: mach-snapdragon: warn on root compatible string truncation

[Casey Connolly <casey.connolly@linaro.org>]

Hi Vivek,

On 10/06/2026 11:37, Vivek Ray wrote:
> The configure_env() function copies root compatible strings into a
> 32-byte buffer prior to parsing. If a compatible string exceeds this
> limit, strlcpy() silently truncates it, producing a malformed fdtfile
> path and a boot failure with no indication of the root cause.
> 
> Add explicit truncation checks after both strlcpy() calls and emit a
> log_warning() with the offending compatible string to make such
> failures easier to diagnose.

Thanks for the patch! Is there a particular board you ran into this
issue with?

If the buffer is too small for some boards then we should definitely
increase it, could you bump it up to 128?

> 
> Signed-off-by: Vivek Ray <vk092kumar@gmail.com>

> ---
>  arch/arm/mach-snapdragon/board.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
> index 829a0109ac7..9324030ae4d 100644
> --- a/arch/arm/mach-snapdragon/board.c
> +++ b/arch/arm/mach-snapdragon/board.c
> @@ -391,6 +391,7 @@ static void configure_env(void)
>  	const char *first_compat, *last_compat;
>  	char *tmp;
>  	char buf[32] = { 0 };
> +	int len = 0;
>  	/*
>  	 * Most DTB filenames follow the scheme: qcom/<soc>-[vendor]-<board>.dtb
>  	 * The vendor is skipped when it's a Qualcomm reference board, or the
> @@ -417,7 +418,10 @@ static void configure_env(void)
>  		return;
>  	}
>  
> -	strlcpy(buf, first_compat, sizeof(buf) - 1);
> +	/* A safety check to avoid silent failure due to name truncation */
> +	len = strlcpy(buf, first_compat, sizeof(buf) - 1);
> +	if (len >= sizeof(buf) - 1)

I think there's an off by 1 here, this should just be > not >=, and the
same below.

Kind regards,

> +		log_warning("compatible '%s' got truncated, fdtfile name too long\n", first_compat);
>  	tmp = buf;
>  
>  	/* The Qualcomm reference boards (RBx, HDK, etc)  */
> @@ -468,7 +472,11 @@ static void configure_env(void)
>  
>  		/* Copy the last compat (e.g. "qcom,sdm845") into buf */
>  		memset(buf, 0, sizeof(buf));
> -		strlcpy(buf, last_compat, sizeof(buf) - 1);
> +
> +		/* check for name truncation */
> +		len = strlcpy(buf, last_compat, sizeof(buf) - 1);
> +		if (len >= sizeof(buf) - 1)
> +			log_warning("compatible '%s' got truncated, fdtfile name too long\n", last_compat);
>  		tmp = buf;
>  
>  		/* strsep() is destructive, it replaces the comma with a \0 */

-- 
// Casey (she/her)