Josh Law f6f380b746 lib/bootconfig: check bounds before writing in __xbc_open_brace() ...

commit 560f763baa upstream.

The bounds check for brace_index happens after the array write.
While the current call pattern prevents an actual out-of-bounds
access (the previous call would have returned an error), the
write-before-check pattern is fragile and would become a real
out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is
self-contained and safe regardless of caller behavior.

Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/

Fixes: ead1e19ad9 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-04-18 10:33:16 +02:00

..

842

lib: 842: Improve error handling in sw842_compress()

2025-04-10 14:32:00 +02:00

crypto

lib/crypto: aes: Fix missing MMU protection for AES S-box

2026-01-19 13:10:13 +01:00

dim

linux/dim: Do nothing if no time delta between samples

2023-05-24 17:36:41 +01:00

fonts

lib/fonts: fix undefined behavior in bit shift for get_default_font

2022-12-31 13:14:02 +01:00

kunit

kunit: Fix timeout message

2024-07-18 13:07:29 +02:00

livepatch

selftests/livepatch: better synchronize test_klp_callbacks_busy

2022-08-17 14:24:03 +02:00

lz4

…

lzo

crypto: lzo - Fix compression buffer overrun

2025-06-04 14:37:58 +02:00

math

bitmap: introduce generic optimized bitmap_size()

2024-09-04 13:23:16 +02:00

mpi

crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init

2024-02-23 08:55:11 +01:00

pldmfw

…

raid6

…

reed_solomon

…

vdso

lib/vdso: use "grep -E" instead of "egrep"

2022-12-02 17:41:08 +01:00

xz

xz: cleanup CRC32 edits from 2018

2024-10-17 15:10:56 +02:00

zlib_deflate

…

zlib_dfltcc

…

zlib_inflate

…

zstd

minmax: make generic MIN() and MAX() macros available everywhere

2025-10-19 16:21:52 +02:00

.gitignore

…

argv_split.c

…

ashldi3.c

…

ashrdi3.c

…

asn1_decoder.c

…

asn1_encoder.c

…

assoc_array.c

…

atomic64_test.c

…

atomic64.c

…

audit.c

…

bcd.c

…

bch.c

…

bitfield_kunit.c

…

bitmap.c

lib: bitmap: Introduce node-aware alloc API

2025-08-28 16:24:02 +02:00

bitrev.c

…

bootconfig.c

lib/bootconfig: check bounds before writing in __xbc_open_brace()

2026-04-18 10:33:16 +02:00

bsearch.c

…

btree.c

minmax: make generic MIN() and MAX() macros available everywhere

2025-10-19 16:21:52 +02:00

bucket_locks.c

…

bug.c

…

build_OID_registry

…

buildid.c

lib/buildid: Handle memfd_secret() files in build_id_parse()

2025-04-10 14:31:52 +02:00

bust_spinlocks.c

…

check_signature.c

…

checksum.c

…

clz_ctz.c

lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels

2023-08-30 16:18:18 +02:00

clz_tab.c

…

cmdline_kunit.c

lib/cmdline: Fix an invalid format specifier in an assertion msg

2024-03-26 18:21:15 -04:00

cmdline.c

…

cmpdi2.c

…

compat_audit.c

…

cpu_rmap.c

lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()

2023-06-14 11:13:04 +02:00

cpumask.c

memblock: drop memblock_free_early_nid() and memblock_free_early()

2025-03-13 12:50:07 +01:00

crc4.c

…

crc7.c

…

crc8.c

…

crc16.c

…

crc32.c

…

crc32defs.h

…

crc32test.c

…

crc64.c

…

crc-ccitt.c

…

crc-itu-t.c

…

crc-t10dif.c

…

ctype.c

…

debug_info.c

…

debug_locks.c

…

debugobjects.c

debugobjects: Fix conditions in fill_pool()

2024-10-17 15:11:14 +02:00

dec_and_lock.c

…

decompress_bunzip2.c

decompress_bunzip2: fix rare decompression failure

2024-08-19 05:45:16 +02:00

decompress_inflate.c

…

decompress_unlz4.c

…

decompress_unlzma.c

minmax: make generic MIN() and MAX() macros available everywhere

2025-10-19 16:21:52 +02:00

decompress_unlzo.c

…

decompress_unxz.c

…

decompress_unzstd.c

…

decompress.c

…

devmem_is_allowed.c

…

devres.c

…

digsig.c

…

dump_stack.c

…

dynamic_debug.c

dyndbg: fix old BUG_ON in >control parser

2024-05-17 11:51:04 +02:00

dynamic_queue_limits.c

dql: Fix dql->limit value when reset.

2025-06-04 14:37:55 +02:00

earlycpio.c

…

errname.c

parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes

2023-12-08 08:48:02 +01:00

error-inject.c

…

errseq.c

…

extable.c

…

fault-inject-usercopy.c

…

fault-inject.c

…

fdt_addresses.c

…

fdt_empty_tree.c

…

fdt_ro.c

…

fdt_rw.c

…

fdt_strerror.c

…

fdt_sw.c

…

fdt_wip.c

…

fdt.c

…

find_bit_benchmark.c

…

find_bit.c

…

flex_proportions.c

…

gen_crc32table.c

…

gen_crc64table.c

…

genalloc.c

lib/genalloc: fix device leak in of_gen_pool_get()

2025-10-19 16:21:45 +02:00

generic-radix-tree.c

lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()

2024-09-12 11:07:50 +02:00

glob.c

…

globtest.c

…

hexdump.c

…

hweight.c

…

idr.c

idr: fix idr_alloc() returning an ID out of range

2026-01-19 13:10:02 +01:00

inflate.c

…

interval_tree_test.c

…

interval_tree.c

…

iomap_copy.c

…

iomap.c

…

iommu-helper.c

…

iov_iter.c

fix short copy handling in copy_mc_pipe_to_iter()

2022-08-17 14:22:51 +02:00

irq_poll.c

…

irq_regs.c

…

is_single_threaded.c

…

kasprintf.c

…

Kconfig

pldmfw: Select CRC32 when PLDMFW is selected

2025-06-27 11:05:35 +01:00

Kconfig.debug

lockdep: Fix upper limit for LOCKDEP_*_BITS configs

2025-03-13 12:50:17 +01:00

Kconfig.kasan

…

Kconfig.kcsan

…

Kconfig.kfence

kfence: allow use of a deferrable timer

2025-03-13 12:50:49 +01:00

Kconfig.kgdb

…

Kconfig.ubsan

…

kfifo.c

…

klist.c

…

kobject_uevent.c

kobject_uevent: Fix OOB access within zap_modalias_env()

2024-08-19 05:45:17 +02:00

kobject.c

kobject: Add sanity check for kset->kobj.ktype in kset_register()

2023-09-23 11:09:59 +02:00

kstrtox.c

…

kstrtox.h

…

libcrc32c.c

…

linear_ranges.c

…

list_debug.c

lib/list_debug.c: Detect uninitialized lists

2022-08-25 11:40:40 +02:00

list_sort.c

…

list-test.c

…

llist.c

…

locking-selftest-hardirq.h

…

locking-selftest-mutex.h

…

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

…

locking-selftest-rsem.h

…

locking-selftest-rtmutex.h

…

locking-selftest-softirq.h

…

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

…

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

…

locking-selftest-wsem.h

…

locking-selftest.c

…

lockref.c

lockref: stop doing cpu_relax in the cmpxchg loop

2023-02-01 08:27:19 +01:00

logic_iomem.c

…

logic_pio.c

minmax: add in_range() macro

2025-10-19 16:21:28 +02:00

lru_cache.c

…

lshrdi3.c

…

Makefile

crypto: memneq - move into lib/

2022-06-22 14:22:03 +02:00

memcat_p.c

…

memneq.c

crypto: memneq - move into lib/

2022-06-22 14:22:03 +02:00

memory-notifier-error-inject.c

…

memregion.c

…

memweight.c

…

muldi3.c

…

net_utils.c

…

netdev-notifier-error-inject.c

…

nlattr.c

netlink: prevent potential spectre v1 gadgets

2023-02-01 08:27:26 +01:00

nmi_backtrace.c

…

nodemask.c

nodemask: Fix return values to be unsigned

2022-06-14 18:36:24 +02:00

notifier-error-inject.c

lib/notifier-error-inject: fix error when writing -errno to debugfs file

2022-12-31 13:14:03 +01:00

notifier-error-inject.h

…

objagg.c

mlxsw: spectrum_acl_erp: Fix object nesting warning

2024-08-19 05:44:56 +02:00

of-reconfig-notifier-error-inject.c

…

oid_registry.c

…

once.c

once: add DO_ONCE_SLOW() for sleepable contexts

2022-10-26 12:34:49 +02:00

packing.c

…

parman.c

…

parser.c

…

pci_iomap.c

pci_iounmap(): Fix MMIO mapping leak

2024-04-10 16:18:34 +02:00

percpu_counter.c

…

percpu_test.c

…

percpu-refcount.c

…

plist.c

…

pm-notifier-error-inject.c

…

radix-tree.c

radix tree: remove unused variable

2023-08-30 16:18:18 +02:00

random32.c

…

ratelimit.c

ratelimit: Fix data-races in ___ratelimit().

2022-08-31 17:16:43 +02:00

rbtree_test.c

…

rbtree.c

…

refcount.c

…

rhashtable.c

…

sbitmap.c

…

scatterlist.c

…

seq_buf.c

…

sg_pool.c

…

sg_split.c

lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets

2025-05-02 07:44:03 +02:00

sha1.c

…

show_mem.c

…

siphash.c

…

slub_kunit.c

mm/slub, kunit: Use inverted data to corrupt kmem cache

2024-06-16 13:39:16 +02:00

smp_processor_id.c

lib/smp_processor_id: fix imbalanced instrumentation_end() call

2022-08-17 14:24:08 +02:00

sort.c

…

stackdepot.c

stackdepot: respect __GFP_NOLOCKDEP allocation flag

2024-05-02 16:24:49 +02:00

stmp_device.c

…

string_helpers.c

lib: string_helpers: silence snprintf() output truncation warning

2024-12-14 19:51:18 +01:00

string.c

string: Add load_unaligned_zeropad() code path to sized_strscpy()

2025-05-02 07:44:28 +02:00

strncpy_from_user.c

…

strnlen_user.c

…

syscall.c

…

test_bitmap.c

…

test_bitops.c

…

test_bits.c

…

test_blackhole_dev.c

net: blackhole_dev: fix build warning for ethh set but not used

2024-03-26 18:21:18 -04:00

test_bpf.c

test_bpf: fix incorrect netdev features

2022-08-17 14:23:23 +02:00

test_debug_virtual.c

…

test_firmware.c

test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation

2023-07-23 13:47:25 +02:00

test_fpu.c

…

test_free_pages.c

…

test_hash.c

…

test_hexdump.c

…

test_hmm_uapi.h

…

test_hmm.c

lib/test_hmm: avoid accessing uninitialized pages

2022-08-17 14:23:43 +02:00

test_ida.c

ida: Fix crash in ida_free when the bitmap is empty

2024-01-25 14:52:30 -08:00

test_kasan_module.c

…

test_kasan.c

kunit: kasan_test: disable fortify string checker on kasan_strings() test

2025-10-02 13:38:59 +02:00

test_kmod.c

…

test_linear_ranges.c

…

test_list_sort.c

…

test_lockup.c

…

test_memcat_p.c

…

test_meminit.c

lib/test_meminit: fix off-by-one error in test_pages()

2023-10-19 23:05:33 +02:00

test_min_heap.c

…

test_module.c

…

test_objagg.c

lib: test_objagg: Set error message in check_expect_hints_stats()

2025-07-10 15:57:45 +02:00

test_overflow.c

overflow: Implement size_t saturating arithmetic helpers

2022-12-31 13:14:33 +01:00

test_parman.c

…

test_printf.c

…

test_rhashtable.c

…

test_scanf.c

lib: test_scanf: Add explicit type cast to result initialization in test_number_prefix()

2023-09-19 12:23:01 +02:00

test_siphash.c

…

test_sort.c

…

test_stackinit.c

lib: stackinit: hide never-taken branch from compiler

2025-01-09 13:28:41 +01:00

test_static_key_base.c

…

test_static_keys.c

…

test_string.c

…

test_strscpy.c

…

test_sysctl.c

…

test_ubsan.c

ubsan: Fix panic from test_ubsan_out_of_bounds

2025-05-02 07:44:38 +02:00

test_user_copy.c

…

test_uuid.c

…

test_vmalloc.c

…

test_xarray.c

…

test-kstrtox.c

…

test-string_helpers.c

…

textsearch.c

…

timerqueue.c

…

ts_bm.c

lib/ts_bm: reset initial match offset for every block of text

2023-07-23 13:46:56 +02:00

ts_fsm.c

…

ts_kmp.c

…

ubsan.c

panic: Consolidate open-coded panic_on_warn checks

2023-02-01 08:27:22 +01:00

ubsan.h

…

ucmpdi2.c

…

ucs2_string.c

…

usercopy.c

uaccess: Add speculation barrier to copy_from_user()

2023-02-25 12:06:44 +01:00

uuid.c

…

vsprintf.c

lib/vsprintf: Check pointer before dereferencing in time_and_date()

2026-01-19 13:09:29 +01:00

win_minmax.c

…

xarray.c

…

xxhash.c

…