diff options
| author | Josh Law <objecting@objecting.org> | 2026-03-12 19:11:41 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-19 16:08:44 +0100 |
| commit | d24330cf241f8d33248f88061a325f67df8644b9 (patch) | |
| tree | f7200ab082909a792ebec0569147b4dc8d5d9236 | |
| parent | d2beb819045e4e6c1224fd10d343c1a0352a136f (diff) | |
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
commit 39ebc8d7f561e1b64eca87353ef9b18e2825e591 upstream.
__xbc_open_brace() pushes entries with post-increment
(open_brace[brace_index++]), so brace_index always points one past
the last valid entry. xbc_verify_tree() reads open_brace[brace_index]
to report which brace is unclosed, but this is one past the last
pushed entry and contains stale/zero data, causing the error message
to reference the wrong node.
Use open_brace[brace_index - 1] to correctly identify the unclosed
brace. brace_index is known to be > 0 here since we are inside the
if (brace_index) guard.
Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/
Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | lib/bootconfig.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/bootconfig.c b/lib/bootconfig.c index 81f29c29f47b..a22e51545fe3 100644 --- a/lib/bootconfig.c +++ b/lib/bootconfig.c @@ -791,7 +791,7 @@ static int __init xbc_verify_tree(void) /* Brace closing */ if (brace_index) { - n = &xbc_nodes[open_brace[brace_index]]; + n = &xbc_nodes[open_brace[brace_index - 1]]; return xbc_parse_error("Brace is not closed", xbc_node_get_data(n)); } |