xbc_node_get_data() uses WARN_ON (non-fatal) when it detects an
invalid data offset, but returns NULL. Multiple callers pass the
result directly to strlen() or strcmp() without NULL checks, which
would cause a NULL pointer dereference after the non-fatal warning:
- xbc_node_match_prefix(): strlen(p) on line 197
- find_match_node(): strcmp(xbc_node_get_data(node), k) on line 644
- xbc_verify_tree(): strlen(xbc_node_get_data(n)) on lines 832, 853
- xbc_node_find_next_key_value(): returns NULL to caller on line 404
Return an empty string instead so the WARN_ON remains non-fatal as
intended. The warning backtrace still signals corruption, but the
kernel won't crash in the callers.
Signed-off-by: Josh Law <objecting@objecting.org>
---
lib/bootconfig.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/bootconfig.c b/lib/bootconfig.c
index 0823491221f4..fae4e6790f34 100644
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -179,14 +179,14 @@ struct xbc_node * __init xbc_node_get_next(struct xbc_node *node)
* @node: An XBC node.
*
* Return the data (which is always a null terminated string) of @node.
- * If the node has invalid data, warn and return NULL.
+ * If the node has invalid data, warn and return an empty string.
*/
const char * __init xbc_node_get_data(struct xbc_node *node)
{
int offset = node->data & ~XBC_VALUE;
if (WARN_ON(offset >= xbc_data_size))
- return NULL;
+ return "";
return xbc_data + offset;
}
--
2.34.1