Skip to content

Commit 46dad3c

Browse files
ytcoodemhiramat
authored andcommitted
init/main.c: Fix potential static_command_line memory overflow
We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310 ("init/main: add checks for the return value of memblock_alloc*()") Link: https://lore.kernel.org/all/20240412081733.35925-2-ytcoode@gmail.com/ Fixes: f5c7310 ("init/main: add checks for the return value of memblock_alloc*()") Cc: stable@vger.kernel.org Signed-off-by: Yuntao Wang <ytcoode@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
1 parent c722cea commit 46dad3c

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

init/main.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -636,6 +636,8 @@ static void __init setup_command_line(char *command_line)
636636
if (!saved_command_line)
637637
panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen);
638638

639+
len = xlen + strlen(command_line) + 1;
640+
639641
static_command_line = memblock_alloc(len, SMP_CACHE_BYTES);
640642
if (!static_command_line)
641643
panic("%s: Failed to allocate %zu bytes\n", __func__, len);

0 commit comments

Comments
 (0)