Hi all,

Today's linux-next merge of the mm-nonmm-unstable tree got a conflict in:

  lib/bootconfig.c

between commit:

  dec4d8118c179 ("bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()")

from the tip-fixes tree and commit:

  9f2274451ae6b ("lib/bootconfig: fix undefined behavior involving NULL pointer arithmetic")

from the mm-nonmm-unstable tree which look like two fixes for the same
issue.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined lib/bootconfig.c
index 2ed9ee3dc81c7,c913259c80ce1..0000000000000
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@@ -427,18 -427,11 +427,18 @@@ static char xbc_namebuf[XBC_KEYLEN_MAX
  int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root)
  {
  	struct xbc_node *knode, *vnode;
 -	char *end = buf ? buf + size : NULL;
  	const char *val, *q;
  	size_t len = 0;
  	int ret;
  
 +	/*
 +	 * Track the running written length rather than advancing @buf, so we
 +	 * never form "buf + size" or "buf += ret" while @buf is NULL (the
 +	 * size-probe call passes buf=NULL, size=0). NULL pointer arithmetic
 +	 * is undefined behavior and trips host UBSan / FORTIFY_SOURCE when
 +	 * this renderer runs at kernel build time. snprintf(NULL, 0, ...)
 +	 * itself is well defined and returns the would-be length.
 +	 */
  	xbc_node_for_each_key_value(root, knode, val) {
  		ret = xbc_node_compose_key_after(root, knode,
  					xbc_namebuf, XBC_KEYLEN_MAX);
@@@ -447,11 -440,12 +447,11 @@@
  
  		vnode = xbc_node_get_child(knode);
  		if (!vnode) {
 -			ret = snprintf(buf, rest(buf, end), "%s ", xbc_namebuf);
 +			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
 +				       "%s ", xbc_namebuf);
  			if (ret < 0)
  				return ret;
  			len += ret;
 -			if (buf)
 -				buf += ret;
  			continue;
  		}
  		xbc_array_for_each_value(vnode, val) {
@@@ -461,11 -455,13 +461,11 @@@
  			 * whitespace.
  			 */
  			q = strpbrk(val, " \t\r\n") ? "\"" : "";
 -			ret = snprintf(buf, rest(buf, end), "%s=%s%s%s ",
 -				       xbc_namebuf, q, val, q);
 +			ret = snprintf(buf ? buf + len : NULL, rest(len, size),
 +				       "%s=%s%s%s ", xbc_namebuf, q, val, q);
  			if (ret < 0)
  				return ret;
  			len += ret;
 -			if (buf)
 -				buf += ret;
  		}
  	}