[PATCH v2 0/4] bootconfig: Reject unexpected data after null character and cleanups

[PATCH v2 0/4] bootconfig: Reject unexpected data after null character and cleanups

[Masami Hiramatsu (Google)]

Hi,

Here are v2 patches for bootconfig to rejects unexpected config data after
null character and other cleanups including tools/bootconfig to consolidate
bootconfig initialization with errors, and skipping internal tree sanity
check in kernel.

The previous version is here:

 https://lore.kernel.org/all/178896921555.177508.434402948295885560.stgit@devnote2/

This version removes redundant buffer copy in init_xbc_with_error() [2/4]
and moves BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h[4/4].

Thank you,

---
base-commit: 7812d6dab0698001e50e8c2f901e17da3eb6f429

Masami Hiramatsu (Google) (4):
      bootconfig: Reject unexpected data after null character
      tools/bootconfig: Consolidate xbc_init() to error message wrapper
      bootconfig: Skip internal tree sanity checks in kernel
      bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h


 include/linux/bootconfig.h          |    4 +
 init/main.c                         |    2 -
 lib/bootconfig.c                    |   45 +++++++++++----
 tools/bootconfig/main.c             |  106 +++++++++++++++--------------------
 tools/bootconfig/test-bootconfig.sh |   12 ++++
 5 files changed, 95 insertions(+), 74 deletions(-)

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH v2 1/4] bootconfig: Reject unexpected data after null character

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

If a bootconfig buffer contains an intermediate null character in the
middle of the configuration, xbc_parse_tree() stops at the null character
because string delimiter searches (e.g. strpbrk()) stop at '\0', and
cleanly breaks out of the loop without error. As a result, any
configuration data following the intermediate null character is silently
ignored, allowing unparsed or potentially malicious data to be hidden
after an early termination.

Fix this in xbc_parse_tree() by checking that no non-null data remains
between the parser termination point and the end of the input buffer.
Trailing null characters (such as alignment padding in initrd) continue
to be accepted as valid.

Also update apply_xbc() in tools/bootconfig/main.c to calculate the
buffer size based on the loaded file size rather than strlen(), so that
files with intermediate null characters are not truncated before
validation.

Assisted-by: Antigravity:gemini-3.8-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>
---
 lib/bootconfig.c                    |    7 +++++++
 tools/bootconfig/main.c             |    4 +++-
 tools/bootconfig/test-bootconfig.sh |   12 ++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 89c88e359179..61cae6d6e3f8 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -1119,6 +1119,13 @@ static int __init xbc_parse_tree(void)
 		}
 	} while (!ret);
 
+	if (!ret) {
+		while (p < xbc_data + xbc_data_size - 1 && *p == '\0')
+			p++;
+		if (p < xbc_data + xbc_data_size - 1)
+			ret = xbc_parse_error("Unexpected data after null character", p);
+	}
+
 	return ret;
 }
 
diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
index 17d971d47f87..aff169ba75b8 100644
--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -433,7 +433,9 @@ static int apply_xbc(const char *path, const char *xbc_path)
 		pr_err("Failed to load %s : %d\n", xbc_path, ret);
 		return ret;
 	}
-	size = strlen(buf) + 1;
+	size = ret;
+	if (size == 0 || buf[size - 1] != '\0')
+		size++;
 	csum = xbc_calc_checksum(buf, size);
 
 	/* Backup the bootconfig data */
diff --git a/tools/bootconfig/test-bootconfig.sh b/tools/bootconfig/test-bootconfig.sh
index fc69f815ce4a..530ce7e28d63 100755
--- a/tools/bootconfig/test-bootconfig.sh
+++ b/tools/bootconfig/test-bootconfig.sh
@@ -180,6 +180,18 @@ EOF
 $BOOTCONF -a $TEMPCONF $INITRD 2> $OUTFILE
 xpass grep -q "1:1" $OUTFILE
 
+echo "Intermediate null character test"
+printf "key = value\n\0extra = data\n" > $TEMPCONF
+xfail $BOOTCONF -a $TEMPCONF $INITRD
+$BOOTCONF -a $TEMPCONF $INITRD 2> $OUTFILE
+xpass grep -q "Unexpected" $OUTFILE
+
+echo "Trailing null character test"
+printf "key = value\n\0" > $TEMPCONF
+xpass $BOOTCONF -a $TEMPCONF $INITRD
+$BOOTCONF $INITRD > $OUTFILE
+xpass grep -q "value" $OUTFILE
+
 echo "=== expected failure cases ==="
 for i in samples/bad-* ; do
   xfail $BOOTCONF -a $i $INITRD

[PATCH v2 2/4] tools/bootconfig: Consolidate xbc_init() to error message wrapper

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Use init_xbc_with_error() for all bootconfig initialization in the
bootconfig tool instead of showing errors in different way.

This simplifies the code logic and make it easy to maintain.

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
Changes in v2:
 - Remove redundant buffer copy in init_xbc_with_error().
---
 tools/bootconfig/main.c |  100 ++++++++++++++++++++---------------------------
 1 file changed, 43 insertions(+), 57 deletions(-)

diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
index aff169ba75b8..652e491b9c33 100644
--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -21,6 +21,39 @@
 #define BOOTCONFIG_FOOTER_SIZE	\
 	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
 
+static void show_xbc_error(const char *data, const char *msg, int pos)
+{
+	int lin = 1, col, i;
+
+	if (pos < 0) {
+		pr_err("Error: %s.\n", msg);
+		return;
+	}
+
+	/* Note that pos starts from 0 but lin and col should start from 1. */
+	col = pos + 1;
+	for (i = 0; i < pos; i++) {
+		if (data[i] == '\n') {
+			lin++;
+			col = pos - i;
+		}
+	}
+	pr_err("Parse Error: %s at %d:%d\n", msg, lin, col);
+
+}
+
+static int init_xbc_with_error(char *buf, int len)
+{
+	const char *msg;
+	int ret, pos;
+
+	ret = xbc_init(buf, len, &msg, &pos);
+	if (ret < 0)
+		show_xbc_error(buf, msg, pos);
+
+	return ret;
+}
+
 static int xbc_show_value(struct xbc_node *node, bool semicolon)
 {
 	const char *val, *eol;
@@ -197,7 +230,6 @@ static int load_xbc_from_initrd(int fd, char **buf)
 	int ret;
 	uint32_t size = 0, csum = 0, rcsum;
 	char magic[BOOTCONFIG_MAGIC_LEN];
-	const char *msg;
 
 	ret = fstat(fd, &stat);
 	if (ret < 0)
@@ -249,52 +281,9 @@ static int load_xbc_from_initrd(int fd, char **buf)
 		return -EINVAL;
 	}
 
-	ret = xbc_init(*buf, size, &msg, NULL);
-	/* Wrong data */
-	if (ret < 0) {
-		pr_err("parse error: %s.\n", msg);
-		return ret;
-	}
-
-	return size;
-}
-
-static void show_xbc_error(const char *data, const char *msg, int pos)
-{
-	int lin = 1, col, i;
-
-	if (pos < 0) {
-		pr_err("Error: %s.\n", msg);
-		return;
-	}
-
-	/* Note that pos starts from 0 but lin and col should start from 1. */
-	col = pos + 1;
-	for (i = 0; i < pos; i++) {
-		if (data[i] == '\n') {
-			lin++;
-			col = pos - i;
-		}
-	}
-	pr_err("Parse Error: %s at %d:%d\n", msg, lin, col);
+	ret = init_xbc_with_error(*buf, size);
 
-}
-
-static int init_xbc_with_error(char *buf, int len)
-{
-	char *copy = strdup(buf);
-	const char *msg;
-	int ret, pos;
-
-	if (!copy)
-		return -ENOMEM;
-
-	ret = xbc_init(buf, len, &msg, &pos);
-	if (ret < 0)
-		show_xbc_error(copy, msg, pos);
-	free(copy);
-
-	return ret;
+	return ret < 0 ? ret : size;
 }
 
 static int show_xbc_kernel_cmdline(void)
@@ -423,9 +412,8 @@ static int apply_xbc(const char *path, const char *xbc_path)
 	char *buf, *data;
 	size_t total_size;
 	struct stat stat;
-	const char *msg;
 	uint32_t size, csum;
-	int pos, pad;
+	int pad;
 	int ret, fd;
 
 	ret = load_xbc_file(xbc_path, &buf);
@@ -438,6 +426,13 @@ static int apply_xbc(const char *path, const char *xbc_path)
 		size++;
 	csum = xbc_calc_checksum(buf, size);
 
+	/* Verify the data format */
+	ret = init_xbc_with_error(buf, size);
+	if (ret < 0) {
+		free(buf);
+		return ret;
+	}
+
 	/* Backup the bootconfig data */
 	data = calloc(size + BOOTCONFIG_ALIGN + BOOTCONFIG_FOOTER_SIZE, 1);
 	if (!data) {
@@ -446,15 +441,6 @@ static int apply_xbc(const char *path, const char *xbc_path)
 	}
 	memcpy(data, buf, size);
 
-	/* Check the data format */
-	ret = xbc_init(buf, size, &msg, &pos);
-	if (ret < 0) {
-		show_xbc_error(data, msg, pos);
-		free(data);
-		free(buf);
-
-		return ret;
-	}
 	printf("Apply %s to %s\n", xbc_path, path);
 	xbc_get_info(&ret, NULL);
 	printf("\tNumber of nodes: %d\n", ret);

Re: [PATCH v2 2/4] tools/bootconfig: Consolidate xbc_init() to error message wrapper

[Sang-Heon Jeon]

On Fri, Sep 11, 2026 at 11:13 PM Masami Hiramatsu (Google)
<mhiramat@kernel.org> wrote:
>
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
>
> Use init_xbc_with_error() for all bootconfig initialization in the
> bootconfig tool instead of showing errors in different way.
>
> This simplifies the code logic and make it easy to maintain.
>
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
> Changes in v2:
>  - Remove redundant buffer copy in init_xbc_with_error().
> ---
>  tools/bootconfig/main.c |  100 ++++++++++++++++++++---------------------------
>  1 file changed, 43 insertions(+), 57 deletions(-)
>
> diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
> index aff169ba75b8..652e491b9c33 100644
> --- a/tools/bootconfig/main.c
> +++ b/tools/bootconfig/main.c
> @@ -21,6 +21,39 @@
>  #define BOOTCONFIG_FOOTER_SIZE \
>         (sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
>
> +static void show_xbc_error(const char *data, const char *msg, int pos)
> +{
> +       int lin = 1, col, i;
> +
> +       if (pos < 0) {
> +               pr_err("Error: %s.\n", msg);
> +               return;
> +       }
> +
> +       /* Note that pos starts from 0 but lin and col should start from 1. */
> +       col = pos + 1;
> +       for (i = 0; i < pos; i++) {
> +               if (data[i] == '\n') {
> +                       lin++;
> +                       col = pos - i;
> +               }
> +       }
> +       pr_err("Parse Error: %s at %d:%d\n", msg, lin, col);
> +
> +}
> +
> +static int init_xbc_with_error(char *buf, int len)
> +{
> +       const char *msg;
> +       int ret, pos;
> +
> +       ret = xbc_init(buf, len, &msg, &pos);
> +       if (ret < 0)
> +               show_xbc_error(buf, msg, pos);
> +
> +       return ret;
> +}
> +
>  static int xbc_show_value(struct xbc_node *node, bool semicolon)
>  {
>         const char *val, *eol;
> @@ -197,7 +230,6 @@ static int load_xbc_from_initrd(int fd, char **buf)
>         int ret;
>         uint32_t size = 0, csum = 0, rcsum;
>         char magic[BOOTCONFIG_MAGIC_LEN];
> -       const char *msg;
>
>         ret = fstat(fd, &stat);
>         if (ret < 0)
> @@ -249,52 +281,9 @@ static int load_xbc_from_initrd(int fd, char **buf)
>                 return -EINVAL;
>         }
>
> -       ret = xbc_init(*buf, size, &msg, NULL);
> -       /* Wrong data */
> -       if (ret < 0) {
> -               pr_err("parse error: %s.\n", msg);
> -               return ret;
> -       }
> -
> -       return size;
> -}
> -
> -static void show_xbc_error(const char *data, const char *msg, int pos)
> -{
> -       int lin = 1, col, i;
> -
> -       if (pos < 0) {
> -               pr_err("Error: %s.\n", msg);
> -               return;
> -       }
> -
> -       /* Note that pos starts from 0 but lin and col should start from 1. */
> -       col = pos + 1;
> -       for (i = 0; i < pos; i++) {
> -               if (data[i] == '\n') {
> -                       lin++;
> -                       col = pos - i;
> -               }
> -       }
> -       pr_err("Parse Error: %s at %d:%d\n", msg, lin, col);
> +       ret = init_xbc_with_error(*buf, size);
>
> -}
> -
> -static int init_xbc_with_error(char *buf, int len)
> -{
> -       char *copy = strdup(buf);
> -       const char *msg;
> -       int ret, pos;
> -
> -       if (!copy)
> -               return -ENOMEM;
> -
> -       ret = xbc_init(buf, len, &msg, &pos);
> -       if (ret < 0)
> -               show_xbc_error(copy, msg, pos);
> -       free(copy);
> -
> -       return ret;
> +       return ret < 0 ? ret : size;
>  }
>
>  static int show_xbc_kernel_cmdline(void)
> @@ -423,9 +412,8 @@ static int apply_xbc(const char *path, const char *xbc_path)
>         char *buf, *data;
>         size_t total_size;
>         struct stat stat;
> -       const char *msg;
>         uint32_t size, csum;
> -       int pos, pad;
> +       int pad;
>         int ret, fd;
>
>         ret = load_xbc_file(xbc_path, &buf);
> @@ -438,6 +426,13 @@ static int apply_xbc(const char *path, const char *xbc_path)
>                 size++;
>         csum = xbc_calc_checksum(buf, size);
>
> +       /* Verify the data format */
> +       ret = init_xbc_with_error(buf, size);
> +       if (ret < 0) {
> +               free(buf);
> +               return ret;
> +       }
> +
>         /* Backup the bootconfig data */
>         data = calloc(size + BOOTCONFIG_ALIGN + BOOTCONFIG_FOOTER_SIZE, 1);
>         if (!data) {
> @@ -446,15 +441,6 @@ static int apply_xbc(const char *path, const char *xbc_path)
>         }
>         memcpy(data, buf, size);
>
> -       /* Check the data format */
> -       ret = xbc_init(buf, size, &msg, &pos);
> -       if (ret < 0) {
> -               show_xbc_error(data, msg, pos);
> -               free(data);
> -               free(buf);
> -
> -               return ret;
> -       }
>         printf("Apply %s to %s\n", xbc_path, path);
>         xbc_get_info(&ret, NULL);
>         printf("\tNumber of nodes: %d\n", ret);
>

Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>

[PATCH v2 3/4] bootconfig: Skip internal tree sanity checks in kernel

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

In xbc_verify_tree(), the loop iterating through all nodes to check that
xbc_nodes[i].next < xbc_node_num and xbc_nodes[i].child < xbc_node_num
is a defensive sanity check against implementation regressions (such
an out-of-bounds index cannot be produced by malformed input).

Running this check in the kernel adds unnecessary boot-time overhead.
Split this check out into xbc_sanity_check_tree() for userspace, so
that it continues to run during userspace bootconfig validation (e.g.
when applying or testing bootconfig with tools/bootconfig), but is
omitted in the kernel to speed up initialization.

Reported-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Closes: https://lore.kernel.org/all/20260905141637.1547429-1-ekffu200098@gmail.com/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>
---
 lib/bootconfig.c |   38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 61cae6d6e3f8..20b3d6e78fea 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -1003,9 +1003,30 @@ static int __init xbc_close_brace(char **k, char *n)
 	return __xbc_close_brace(n - 1);
 }
 
+#ifndef __KERNEL__
+/* Sanity check for regression: node indices must be within bounds */
+static int __init xbc_sanity_check_tree(void)
+{
+	int i;
+
+	for (i = 0; i < xbc_node_num; i++) {
+		if (xbc_nodes[i].next >= xbc_node_num) {
+			return xbc_parse_error("No closing brace",
+				xbc_node_get_data(xbc_nodes + i));
+		}
+		if (xbc_nodes[i].child >= xbc_node_num) {
+			return xbc_parse_error("Broken child node",
+				xbc_node_get_data(xbc_nodes + i));
+		}
+	}
+
+	return 0;
+}
+#endif
+
 static int __init xbc_verify_tree(void)
 {
-	int i, depth;
+	int depth;
 	size_t len, wlen;
 	struct xbc_node *n, *m;
 
@@ -1022,17 +1043,6 @@ static int __init xbc_verify_tree(void)
 		return -ENOENT;
 	}
 
-	for (i = 0; i < xbc_node_num; i++) {
-		if (xbc_nodes[i].next >= xbc_node_num) {
-			return xbc_parse_error("No closing brace",
-				xbc_node_get_data(xbc_nodes + i));
-		}
-		if (xbc_nodes[i].child >= xbc_node_num) {
-			return xbc_parse_error("Broken child node",
-				xbc_node_get_data(xbc_nodes + i));
-		}
-	}
-
 	/* Key tree limitation check */
 	n = &xbc_nodes[0];
 	depth = 1;
@@ -1203,6 +1213,10 @@ int __init xbc_init(const char *data, size_t size, const char **emsg, int *epos)
 	ret = xbc_parse_tree();
 	if (!ret)
 		ret = xbc_verify_tree();
+#ifndef __KERNEL__
+	if (!ret)
+		ret = xbc_sanity_check_tree();
+#endif
 
 	if (ret < 0) {
 		if (epos)

[PATCH v2 4/4] bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

BOOTCONFIG_FOOTER_SIZE was defined locally in tools/bootconfig/main.c.
Move it to include/linux/bootconfig.h so that it can be shared with
the kernel and user-space tools. Also, use it in init/main.c instead
of the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression when checking
the initrd size.

Suggested-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 Changes in v2:
  - Newly added.
---
 include/linux/bootconfig.h |    4 ++++
 init/main.c                |    2 +-
 tools/bootconfig/main.c    |    4 ----
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/bootconfig.h b/include/linux/bootconfig.h
index deda507500da..6f23ec11baab 100644
--- a/include/linux/bootconfig.h
+++ b/include/linux/bootconfig.h
@@ -27,6 +27,10 @@ bool __init cmdline_has_extra_options(void);
 #define BOOTCONFIG_ALIGN	(1 << BOOTCONFIG_ALIGN_SHIFT)
 #define BOOTCONFIG_ALIGN_MASK	(BOOTCONFIG_ALIGN - 1)
 
+/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
+#define BOOTCONFIG_FOOTER_SIZE	\
+	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
+
 /**
  * xbc_calc_checksum() - Calculate checksum of bootconfig
  * @data: Bootconfig data.
diff --git a/init/main.c b/init/main.c
index 16749bb7a219..37168bd68126 100644
--- a/init/main.c
+++ b/init/main.c
@@ -278,7 +278,7 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
 	int i;
 
 	if (!initrd_end || initrd_end < initrd_start ||
-	    initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
+	    initrd_end - initrd_start < BOOTCONFIG_FOOTER_SIZE)
 		return NULL;
 
 	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
index 652e491b9c33..d4aa96da970e 100644
--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -17,10 +17,6 @@
 
 #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
 
-/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
-#define BOOTCONFIG_FOOTER_SIZE	\
-	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
-
 static void show_xbc_error(const char *data, const char *msg, int pos)
 {
 	int lin = 1, col, i;

Re: [PATCH v2 4/4] bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h

[Sang-Heon Jeon]

On Fri, Sep 11, 2026 at 11:13 PM Masami Hiramatsu (Google)
<mhiramat@kernel.org> wrote:
>
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
>
> BOOTCONFIG_FOOTER_SIZE was defined locally in tools/bootconfig/main.c.
> Move it to include/linux/bootconfig.h so that it can be shared with
> the kernel and user-space tools. Also, use it in init/main.c instead
> of the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression when checking
> the initrd size.
>
> Suggested-by: Sang-Heon Jeon <ekffu200098@gmail.com>
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
>  Changes in v2:
>   - Newly added.
> ---
>  include/linux/bootconfig.h |    4 ++++
>  init/main.c                |    2 +-
>  tools/bootconfig/main.c    |    4 ----
>  3 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/include/linux/bootconfig.h b/include/linux/bootconfig.h
> index deda507500da..6f23ec11baab 100644
> --- a/include/linux/bootconfig.h
> +++ b/include/linux/bootconfig.h
> @@ -27,6 +27,10 @@ bool __init cmdline_has_extra_options(void);
>  #define BOOTCONFIG_ALIGN       (1 << BOOTCONFIG_ALIGN_SHIFT)
>  #define BOOTCONFIG_ALIGN_MASK  (BOOTCONFIG_ALIGN - 1)
>
> +/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
> +#define BOOTCONFIG_FOOTER_SIZE \
> +       (sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
> +
>  /**
>   * xbc_calc_checksum() - Calculate checksum of bootconfig
>   * @data: Bootconfig data.
> diff --git a/init/main.c b/init/main.c
> index 16749bb7a219..37168bd68126 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -278,7 +278,7 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
>         int i;
>
>         if (!initrd_end || initrd_end < initrd_start ||
> -           initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
> +           initrd_end - initrd_start < BOOTCONFIG_FOOTER_SIZE)
>                 return NULL;

Cool!

>         data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
> diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
> index 652e491b9c33..d4aa96da970e 100644
> --- a/tools/bootconfig/main.c
> +++ b/tools/bootconfig/main.c
> @@ -17,10 +17,6 @@
>
>  #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
>
> -/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
> -#define BOOTCONFIG_FOOTER_SIZE \
> -       (sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
> -
>  static void show_xbc_error(const char *data, const char *msg, int pos)
>  {
>         int lin = 1, col, i;
>

Thank you :)

Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>

Best regards,
Sang-Heon Jeon

Re: [PATCH v2 0/4] bootconfig: Reject unexpected data after null character and cleanups

[Andrew Morton]

On Fri, 11 Sep 2026 23:12:56 +0900 "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> Hi,
> 
> Here are v2 patches for bootconfig to rejects unexpected config data after
> null character and other cleanups including tools/bootconfig to consolidate
> bootconfig initialization with errors, and skipping internal tree sanity
> check in kernel.
> 
> ...
>

Thanks, I've updateed mm.git's mm-nonmm-unstable branch to this version,

> This version removes redundant buffer copy in init_xbc_with_error() [2/4]
> and moves BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h[4/4].

Here's how v2 altered mm.git:


 include/linux/bootconfig.h |    4 ++++
 init/main.c                |    2 +-
 tools/bootconfig/main.c    |   14 +-------------
 3 files changed, 6 insertions(+), 14 deletions(-)

--- a/include/linux/bootconfig.h~b
+++ a/include/linux/bootconfig.h
@@ -27,6 +27,10 @@ bool __init cmdline_has_extra_options(vo
 #define BOOTCONFIG_ALIGN	(1 << BOOTCONFIG_ALIGN_SHIFT)
 #define BOOTCONFIG_ALIGN_MASK	(BOOTCONFIG_ALIGN - 1)
 
+/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
+#define BOOTCONFIG_FOOTER_SIZE	\
+	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
+
 /**
  * xbc_calc_checksum() - Calculate checksum of bootconfig
  * @data: Bootconfig data.
--- a/init/main.c~b
+++ a/init/main.c
@@ -278,7 +278,7 @@ static void * __init get_boot_config_fro
 	int i;
 
 	if (!initrd_end || initrd_end < initrd_start ||
-	    initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
+	    initrd_end - initrd_start < BOOTCONFIG_FOOTER_SIZE)
 		return NULL;
 
 	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
--- a/tools/bootconfig/main.c~b
+++ a/tools/bootconfig/main.c
@@ -17,10 +17,6 @@
 
 #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
 
-/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
-#define BOOTCONFIG_FOOTER_SIZE	\
-	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
-
 static void show_xbc_error(const char *data, const char *msg, int pos)
 {
 	int lin = 1, col, i;
@@ -44,20 +40,12 @@ static void show_xbc_error(const char *d
 
 static int init_xbc_with_error(char *buf, int len)
 {
-	char *copy = malloc(len);
 	const char *msg;
 	int ret, pos;
 
-	if (!copy)
-		return -ENOMEM;
-
-	memcpy(copy, buf, len);
-	/* We do not terminate the copy with \0 for sanity checking */
-
 	ret = xbc_init(buf, len, &msg, &pos);
 	if (ret < 0)
-		show_xbc_error(copy, msg, pos);
-	free(copy);
+		show_xbc_error(buf, msg, pos);
 
 	return ret;
 }
_

Re: [PATCH v2 0/4] bootconfig: Reject unexpected data after null character and cleanups

[Masami Hiramatsu]

On Fri, 11 Sep 2026 15:59:11 -0700
Andrew Morton <akpm@linux-foundation.org> wrote:

> On Fri, 11 Sep 2026 23:12:56 +0900 "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> 
> > Hi,
> > 
> > Here are v2 patches for bootconfig to rejects unexpected config data after
> > null character and other cleanups including tools/bootconfig to consolidate
> > bootconfig initialization with errors, and skipping internal tree sanity
> > check in kernel.
> > 
> > ...
> >
> 
> Thanks, I've updateed mm.git's mm-nonmm-unstable branch to this version,
> 
> > This version removes redundant buffer copy in init_xbc_with_error() [2/4]
> > and moves BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h[4/4].

OK, anyway I'll pick this series to bootconfig/for-next.

Thank you,

> 
> Here's how v2 altered mm.git:
> 
> 
>  include/linux/bootconfig.h |    4 ++++
>  init/main.c                |    2 +-
>  tools/bootconfig/main.c    |   14 +-------------
>  3 files changed, 6 insertions(+), 14 deletions(-)
> 
> --- a/include/linux/bootconfig.h~b
> +++ a/include/linux/bootconfig.h
> @@ -27,6 +27,10 @@ bool __init cmdline_has_extra_options(vo
>  #define BOOTCONFIG_ALIGN	(1 << BOOTCONFIG_ALIGN_SHIFT)
>  #define BOOTCONFIG_ALIGN_MASK	(BOOTCONFIG_ALIGN - 1)
>  
> +/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
> +#define BOOTCONFIG_FOOTER_SIZE	\
> +	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
> +
>  /**
>   * xbc_calc_checksum() - Calculate checksum of bootconfig
>   * @data: Bootconfig data.
> --- a/init/main.c~b
> +++ a/init/main.c
> @@ -278,7 +278,7 @@ static void * __init get_boot_config_fro
>  	int i;
>  
>  	if (!initrd_end || initrd_end < initrd_start ||
> -	    initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
> +	    initrd_end - initrd_start < BOOTCONFIG_FOOTER_SIZE)
>  		return NULL;
>  
>  	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
> --- a/tools/bootconfig/main.c~b
> +++ a/tools/bootconfig/main.c
> @@ -17,10 +17,6 @@
>  
>  #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
>  
> -/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
> -#define BOOTCONFIG_FOOTER_SIZE	\
> -	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
> -
>  static void show_xbc_error(const char *data, const char *msg, int pos)
>  {
>  	int lin = 1, col, i;
> @@ -44,20 +40,12 @@ static void show_xbc_error(const char *d
>  
>  static int init_xbc_with_error(char *buf, int len)
>  {
> -	char *copy = malloc(len);
>  	const char *msg;
>  	int ret, pos;
>  
> -	if (!copy)
> -		return -ENOMEM;
> -
> -	memcpy(copy, buf, len);
> -	/* We do not terminate the copy with \0 for sanity checking */
> -
>  	ret = xbc_init(buf, len, &msg, &pos);
>  	if (ret < 0)
> -		show_xbc_error(copy, msg, pos);
> -	free(copy);
> +		show_xbc_error(buf, msg, pos);
>  
>  	return ret;
>  }
> _
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>