bootcmdline_append() passes "max" (the maximum length of the source string "s") as the destination buffer size argument to strlcat(). Because strlcat() expects the total size of the destination buffer (COMMAND_LINE_SIZE), it fails to append anything whenever "max" is smaller than the current length of boot_command_line, and could overflow boot_command_line if "max" exceeds COMMAND_LINE_SIZE.
In preparation for removing the deprecated strlcat() API[1], replace the strlcat() calls with snprintf() using the "%.*s" precision specifier. This bounds the read from "s" to at most "max" bytes while properly respecting the remaining space in boot_command_line. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: [email protected] Assisted-by: SecurityEngineer:Gemini2.5Pro [editor_update_file, shell_command_run, make_kernel_build_single_file, test_runner_run_kunit_test] Signed-off-by: Bill Wendling <[email protected]> --- Cc: Russell King <[email protected]> Cc: Huacai Chen <[email protected]> Cc: WANG Xuerui <[email protected]> Cc: Thomas Bogendoerfer <[email protected]> Cc: "James E.J. Bottomley" <[email protected]> Cc: Helge Deller <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Dave Hansen <[email protected]> Cc: [email protected] Cc: "H. Peter Anvin" <[email protected]> Cc: Ian Abbott <[email protected]> Cc: H Hartley Sweeten <[email protected]> Cc: Tony Luck <[email protected]> Cc: Maarten Lankhorst <[email protected]> Cc: Maxime Ripard <[email protected]> Cc: Thomas Zimmermann <[email protected]> Cc: David Airlie <[email protected]> Cc: Simona Vetter <[email protected]> Cc: Matthew Brost <[email protected]> Cc: "Thomas Hellström" <[email protected]> Cc: Rodrigo Vivi <[email protected]> Cc: Dmitry Torokhov <[email protected]> Cc: Matthias Schwarzott <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: Tony Nguyen <[email protected]> Cc: Przemek Kitszel <[email protected]> Cc: Andrew Lunn <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Jakub Kicinski <[email protected]> Cc: Paolo Abeni <[email protected]> Cc: Arend van Spriel <[email protected]> Cc: Rob Herring <[email protected]> Cc: Saravana Kannan <[email protected]> Cc: Krzysztof Kozlowski <[email protected]> Cc: Sylwester Nawrocki <[email protected]> Cc: Peter Griffin <[email protected]> Cc: Alim Akhtar <[email protected]> Cc: Linus Walleij <[email protected]> Cc: Anil Gurumurthy <[email protected]> Cc: Sudarsana Kalluru <[email protected]> Cc: "Martin K. Petersen" <[email protected]> Cc: Trond Myklebust <[email protected]> Cc: Anna Schumaker <[email protected]> Cc: Mike Marshall <[email protected]> Cc: Martin Brandenburg <[email protected]> Cc: Kees Cook <[email protected]> Cc: Jiri Pirko <[email protected]> Cc: Simon Horman <[email protected]> Cc: Chuck Lever <[email protected]> Cc: Jeff Layton <[email protected]> Cc: NeilBrown <[email protected]> Cc: Olga Kornievskaia <[email protected]> Cc: Dai Ngo <[email protected]> Cc: Tom Talpey <[email protected]> Cc: Jaroslav Kysela <[email protected]> Cc: Takashi Iwai <[email protected]> Cc: Bill Wendling <[email protected]> Cc: Andrew Morton <[email protected]> Cc: "Mike Rapoport (Microsoft)" <[email protected]> Cc: Kanglong Wang <[email protected]> Cc: Tiezhu Yang <[email protected]> Cc: Qiang Ma <[email protected]> Cc: Randy Dunlap <[email protected]> Cc: Pengpeng Hou <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Breno Leitao <[email protected]> Cc: Thorsten Blum <[email protected]> Cc: Harshit Mogalapalli <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Lyude Paul <[email protected]> Cc: Ashutosh Desai <[email protected]> Cc: Imre Deak <[email protected]> Cc: Dmitry Baryshkov <[email protected]> Cc: Johan Hovold <[email protected]> Cc: Johannes Berg <[email protected]> Cc: Miri Korenblit <[email protected]> Cc: Alexander Stein <[email protected]> Cc: Cryolitia PukNgae <[email protected]> Cc: Jiaming Zhang <[email protected]> Cc: Will Porter <[email protected]> Cc: Cen Zhang <[email protected]> Cc: "Cássio Gabriel" <[email protected]> Cc: Rong Zhang <[email protected]> Cc: Arun Raghavan <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] --- arch/mips/kernel/setup.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c index 1ae6d0c0e1d6..0d9c2137d675 100644 --- a/arch/mips/kernel/setup.c +++ b/arch/mips/kernel/setup.c @@ -518,13 +518,28 @@ static void __init check_kernel_sections_mem(void) static void __init bootcmdline_append(const char *s, size_t max) { + size_t len; + int prec; + if (!s[0] || !max) return; - if (boot_command_line[0]) - strlcat(boot_command_line, " ", COMMAND_LINE_SIZE); + len = strlen(boot_command_line); + if (len >= COMMAND_LINE_SIZE - 1) + return; - strlcat(boot_command_line, s, max); + if (len) { + if (COMMAND_LINE_SIZE - len < 3) + return; + + prec = min_t(size_t, max, COMMAND_LINE_SIZE - len - 2); + snprintf(boot_command_line + len, COMMAND_LINE_SIZE - len, " %.*s", + prec, s); + } else { + prec = min_t(size_t, max, COMMAND_LINE_SIZE - 1); + snprintf(boot_command_line, COMMAND_LINE_SIZE, "%.*s", + prec, s); + } } #ifdef CONFIG_OF_EARLY_FLATTREE -- 2.55.0.1032.g73a4cd73de-goog
