Skip to contentSkip to conversation

x86/boot: Reject overlong acpi_rsdp= values

PATCH In review Thorsten Blum 1 participant 2 messages Jun 21 – Jul 7

Subsystems (2)
Stable branch x86
lore
Share & tools
lore

Thorsten Blum

author
#0 lore raw

PATCH v3 1/1 x86/boot: Reject overlong acpi_rsdp= values

cmdline_find_option() returns the full length of the acpi_rsdp= value even if it is truncated. However, get_cmdline_acpi_rsdp() only checks whether acpi_rsdp= is present and does not reject overlong values that do not fit in the buffer.

Reject overlong values and warn to prevent boot_kstrtoul() from parsing a truncated value and thus from silently using the wrong RSDP address.

Fixes 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
Cc [email protected]
Signed-off-by Thorsten Blum <[email protected]>

---
Changes in v3:
- Drop the newline as warn() already prints newlines around the message
- v2: https://lore.kernel.org/r/[email protected]/

Changes in v2:
- Warn on overlong acpi_rsdp= values (Boris)
- v1: https://lore.kernel.org/r/[email protected]/

---
 arch/x86/boot/compressed/acpi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/boot/compressed/acpi.c +6 -1
index f196b1d1ddf8..aed27604c11f 100644
@@ -184,10 +184,15 @@ static unsigned long get_cmdline_acpi_rsdp(void)
 	char val[MAX_ADDR_LEN] = { };
 	int ret;
 
-	ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
+	ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
 	if (ret < 0)
 		return 0;
 
+	if (ret >= sizeof(val)) {
+		warn("acpi_rsdp= value too long; ignoring");
+		return 0;
+	}
+
 	if (boot_kstrtoul(val, 16, &addr))
 		return 0;
 #endif
author
#1 lore raw
Quoted 34 lines · Thorsten Blum

cmdline_find_option() returns the full length of the acpi_rsdp= value even if it is truncated. However, get_cmdline_acpi_rsdp() only checks whether acpi_rsdp= is present and does not reject overlong values that do not fit in the buffer.

Reject overlong values and warn to prevent boot_kstrtoul() from parsing a truncated value and thus from silently using the wrong RSDP address.

Fixes 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
Cc [email protected]
Signed-off-by Thorsten Blum <[email protected]>

---
Changes in v3:
- Drop the newline as warn() already prints newlines around the message
- v2: https://lore.kernel.org/r/[email protected]/

Changes in v2:
- Warn on overlong acpi_rsdp= values (Boris)
- v1: https://lore.kernel.org/r/[email protected]/

---
 arch/x86/boot/compressed/acpi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/boot/compressed/acpi.c +1 -1
index f196b1d1ddf8..aed27604c11f 100644
@@ -184,10 +184,15 @@ static unsigned long get_cmdline_acpi_rsdp(void)
 	char val[MAX_ADDR_LEN] = { };
 	int ret;
 
-	ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
+	ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
 	if (ret < 0)

arch/x86/boot/compressed/acpi.c static unsigned long get_cmdline_acpi_rsdp(void) · line 198

Quoted 10 lines
arch/x86/boot/compressed/acpi.c +5 -0
 		return 0;
 
+	if (ret >= sizeof(val)) {
+		warn("acpi_rsdp= value too long; ignoring");
+		return 0;
+	}
+
 	if (boot_kstrtoul(val, 16, &addr))
 		return 0;
 #endif

Hi Boris,

Could you please take another look at this when you get a chance?

Thanks,
Thorsten