kernel/git/stable/linux-stable.git/tools/bootconfig/main.c, branch master

tools/bootconfig: Fix integer overflow and truncation in size checks

2026-09-11T14:05:38+00:00

Sashiko reported that on 32-bit systems, if an attacker crafts size in the bootconfig footer such that adding BOOTCONFIG_FOOTER_SIZE wraps around (for instance, if size is 0xFFFFFFFF), the size check in load_xbc_from_initrd() can be bypassed: if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) { pr_err("bootconfig size is too big\n"); return -E2BIG; } Furthermore, on 64-bit systems with an initrd > 4.29 GB, comparing a corrupted 32-bit size (e.g. 0xFFFFFFFF) against stat.st_size - BOOTCONFIG_FOOTER_SIZE can also bypass the check if size is not bounded. Similarly, load_xbc_file() passes 64-bit stat.st_size directly into the 32-bit int size parameter of load_xbc_fd(), truncating large standalone files (>= 2GB). In both cases, passing 0xFFFFFFFF to load_xbc_fd() truncates to -1, resulting in malloc(0), an integer overflow in read(), and an out-of-bounds null-byte write. Fix this by: 1. Rejecting size > XBC_DATA_MAX or size > stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd(). 2. Rejecting stat.st_size > XBC_DATA_MAX in load_xbc_file() before passing it to load_xbc_fd(). 3. Checking size < 0 || size > XBC_DATA_MAX defensively in load_xbc_fd(). Link: https://lore.kernel.org/all/178905332413.213925.3179977110281463499.stgit@devnote2/ Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260909161113.16C691F00A3A@smtp.kernel.org/ Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/ Assisted-by: Antigravity:gemini-3.8-flash Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Sang-Heon Jeon

Merge tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

2026-06-16T11:59:24+00:00

Pull bootconfig updates from Masami Hiramatsu: - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Move the xbc_snprint_cmdline() function and its buffer from main.c to the shared lib/bootconfig.c parser library so it can be reused by userspace tools. - render kernel.* subtree as cmdline string with -C Add a new -C option to print the kernel.* subtree as a flat command-line string at build time, allowing early parameter injection without runtime parsing. * tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/bootconfig: render kernel.* subtree as cmdline string with -C bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c

tools/bootconfig: Fix buf leaks in apply_xbc

2026-05-21T02:42:27+00:00

If data calloc failed, free the buf before return. Link: https://lore.kernel.org/all/20260520030126.147782-1-lihongtao@kylinos.cn/ Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Signed-off-by: Hongtao Lee Signed-off-by: Masami Hiramatsu (Google)

tools/bootconfig: render kernel.* subtree as cmdline string with -C

2026-05-12T00:44:40+00:00

Add a -C option that finds the "kernel" subtree of a bootconfig file and prints it as a flat, space-separated cmdline string by calling the shared xbc_snprint_cmdline() renderer. An empty or absent kernel.* subtree produces empty output and exits successfully. This lets the kernel build embed a bootconfig file as a plain cmdline string at build time, so embedded bootconfig values can reach parse_early_param() during architecture setup without parsing the bootconfig at runtime. The renderer is intentionally limited to the kernel.* subtree: that is the only thing the kernel build needs to embed; init.* and other subtrees keep going through the runtime parser. Example of this new mode: # cat /tmp/test.bconf kernel { foo = bar baz = "hello world" arr = 1, 2 } init.foo = nope # ./tools/bootconfig/bootconfig -C /tmp/test.bconf foo=bar baz="hello world" arr=1 arr=2 % Link: https://lore.kernel.org/all/20260508-bootconfig_using_tools-v1-2-1132219aa773@debian.org/ Signed-off-by: Breno Leitao Signed-off-by: Masami Hiramatsu (Google)

tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure

2026-03-18T23:43:06+00:00

If fstat() fails after open() succeeds, the function returns without closing the file descriptor. Also preserve errno across close(), since close() may overwrite it before the error is returned. Link: https://lore.kernel.org/all/20260318155847.78065-3-objecting@objecting.org/ Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google)

bootconfig: Fix negative seeks on 32-bit with LFS enabled

2025-08-20T23:16:31+00:00

Commit 26dda5769509 "tools/bootconfig: Cleanup bootconfig footer size calculations" replaced some expressions of type int with the BOOTCONFIG_FOOTER_SIZE macro, which expands to an expression of type size_t, which is unsigned. On 32-bit architectures with LFS enabled (i.e. off_t is 64-bit), the seek offset of -BOOTCONFIG_FOOTER_SIZE now turns into a positive value. Fix this by casting the size to off_t before negating it. Just in case someone changes BOOTCONFIG_MAGIC_LEN to have type size_t later, do the same thing to the seek offset of -BOOTCONFIG_MAGIC_LEN. Link: https://lore.kernel.org/all/aKHlevxeg6Y7UQrz@decadent.org.uk/ Fixes: 26dda5769509 ("tools/bootconfig: Cleanup bootconfig footer size calculations") Signed-off-by: Ben Hutchings Signed-off-by: Masami Hiramatsu (Google)

bootconfig: Fix unaligned access when building footer

2025-07-24T13:16:48+00:00

Currently we add padding between the bootconfig text and footer to ensure that the footer is aligned within the initramfs image. However, because only the bootconfig data is held in memory, not the full initramfs image, the footer may not be naturally aligned in memory. This can result in an alignment fault (SIGBUS) when writing the footer on some architectures, such as sparc. Build the footer in a struct on the stack before adding it to the buffer. References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0 Link: https://lore.kernel.org/all/aIC-NTw-cdm9ZGFw@decadent.org.uk/ Signed-off-by: Ben Hutchings Signed-off-by: Masami Hiramatsu (Google)

tools/bootconfig: Cleanup bootconfig footer size calculations

2025-07-14T02:56:11+00:00

There are many same pattern of 8 + BOOTCONFIG_MAGIC_LEN for calculating the size of bootconfig footer. Use BOOTCONFIG_FOOTER_SIZE macro to clean up those magic numbers. Link: https://lore.kernel.org/all/175211425693.2591046.16029516706923643510.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google)

tools/bootconfig: Fix the wrong format specifier

2025-01-28T14:27:01+00:00

Use '%u' instead of '%d' for unsigned int. Link: https://lore.kernel.org/all/20241105011048.201629-1-luoyifan@cmss.chinamobile.com/ Fixes: 973780011106 ("tools/bootconfig: Suppress non-error messages") Signed-off-by: Luo Yifan Signed-off-by: Masami Hiramatsu (Google)

bootconfig: Cleanup dummy headers in tools/bootconfig

2021-10-11T02:16:02+00:00

Cleanup dummy headers in tools/bootconfig/include except for tools/bootconfig/include/linux/bootconfig.h. For this change, I use __KERNEL__ macro to split kernel header #include and introduce xbc_alloc_mem() and xbc_free_mem(). Link: https://lkml.kernel.org/r/163187299574.2366983.18371329724128746091.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware)