Commit f992846d authored by Pengpeng Hou's avatar Pengpeng Hou Committed by Thomas Bogendoerfer
Browse files

MIPS: validate DT bootargs before appending them 



bootcmdline_scan_chosen() fetches the raw flat-DT bootargs property and
passes it straight to bootcmdline_append(). That helper later feeds the
same pointer into strlcat(), which computes strlen(src) before copying.
Flat DT properties are external boot input, and this path does not
prove that bootargs is NUL-terminated within its declared bounds.

Reject unterminated bootargs properties before appending them to the
kernel command line.

Signed-off-by: default avatarPengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: default avatarThomas Bogendoerfer <tsbogend@alpha.franken.de>
parent d1d0aa62

arch/mips/kernel/setup.c

+4 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ 
#include <linux/of_fdt.h>

#include <linux/dmi.h>

#include <linux/crash_dump.h>

#include <linux/string.h>



#include <asm/addrspace.h>

#include <asm/bootinfo.h>
@@ -541,6 +542,9 @@ static int __init bootcmdline_scan_chosen(unsigned long node, const char *uname, 


	p = of_get_flat_dt_prop(node, "bootargs", &l);

	if (p != NULL && l > 0) {

		if (strnlen(p, l) >= l)

			return 1;



		bootcmdline_append(p, min(l, COMMAND_LINE_SIZE));

		*dt_bootargs = true;

	}