Hi Frieder,
On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote:
> bootstd: rauc: Fix overflow of the BOOT_x_LEFT name buffer
>
> The name of the BOOT_x_LEFT variable of a slot is written into a stack
> buffer of BOOT_LEFT_LEN bytes with sprintf(). BOOT_LEFT_LEN leaves room
> for a slot name of 32 characters, but not for the terminating NUL, and
> longer names are not limited at all.
>
> When booting, the slot names come from BOOT_ORDER in the environment,
> which is only checked against the configured slots when the bootflow is
> read. Setting BOOT_ORDER to a long name between 'bootflow scan' and
> 'bootflow boot' therefore overflows the buffer in find_active_slot().
>
> Make room for the NUL, and write the name with snprintf() in a helper
> that fails with -E2BIG if it does not fit.
>
> Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc")
> Assisted-by: LLM
> Signed-off-by: Frieder Schrempf <[email protected]>
>
> boot/bootmeth_rauc.c | 34 +++++++++++++++++++++++++++-------
> 1 file changed, 27 insertions(+), 7 deletions(-)
> diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c
> @@ -167,7 +176,10 @@ static int distro_rauc_read_bootflow(struct udevice
> *dev, struct bootflow *bflow
> - sprintf(boot_left, "BOOT_%s_LEFT", default_boot_order_list[i]);
> + if (boot_left_name(boot_left, default_boot_order_list[i])) {
> + str_free_list(default_boot_order_list);
> + return log_msg_ret("env", -E2BIG);
> + }
This is a build-time configuration error: a slot name longer than 32
characters in CONFIG_BOOTMETH_RAUC_BOOT_ORDER now quietly produces no
bootflow, and the log_msg_ret() output only appears with
CONFIG_LOG_ERROR_RETURN enabled. Please can you add a log_err() here,
as you do for the missing partition names in patch 6, and mention the
32-character limit in the BOOTMETH_RAUC_BOOT_ORDER help? Also, the
other callers pass on the helper's return value, so it would be worth
returning 'ret' rather than repeating -E2BIG here.
Reviewed-by: Simon Glass <[email protected]>
