6.8-stable patches

[thirdparty/kernel/stable-queue.git] / queue-6.8 / init-main.c-fix-potential-static_command_line-memory-overflow.patch

diff --git a/queue-6.8/init-main.c-fix-potential-static_command_line-memory-overflow.patch b/queue-6.8/init-main.c-fix-potential-static_command_line-memory-overflow.patch
new file mode 100644 (file)
index 0000000..5680f68
--- /dev/null
+++ b/queue-6.8/init-main.c-fix-potential-static_command_line-memory-overflow.patch
@@ -0,0 +1,43 @@
+From 46dad3c1e57897ab9228332f03e1c14798d2d3b9 Mon Sep 17 00:00:00 2001
+From: Yuntao Wang <ytcoode@gmail.com>
+Date: Fri, 12 Apr 2024 16:17:32 +0800
+Subject: init/main.c: Fix potential static_command_line memory overflow
+
+From: Yuntao Wang <ytcoode@gmail.com>
+
+commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream.
+
+We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for
+static_command_line, but the strings copied into static_command_line are
+extra_command_line and command_line, rather than extra_command_line and
+boot_command_line.
+
+When strlen(command_line) > strlen(boot_command_line), static_command_line
+will overflow.
+
+This patch just recovers strlen(command_line) which was miss-consolidated
+with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add
+checks for the return value of memblock_alloc*()")
+
+Link: https://lore.kernel.org/all/20240412081733.35925-2-ytcoode@gmail.com/
+
+Fixes: f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ init/main.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/init/main.c
++++ b/init/main.c
+@@ -635,6 +635,8 @@ static void __init setup_command_line(ch
+       if (!saved_command_line)
+               panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen);
+ 
++      len = xlen + strlen(command_line) + 1;
++
+       static_command_line = memblock_alloc(len, SMP_CACHE_BYTES);
+       if (!static_command_line)
+               panic("%s: Failed to allocate %zu bytes\n", __func__, len);