[PATCH 5.10.y 2/6] params: Do not go over the limit when getting the string length
From: Sasha Levin <sashal@kernel.org>
Date: 2026-09-08 18:28:49
Subsystem:
the rest · Maintainer:
Linus Torvalds
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> [ Upstream commit fd0cd057a1b7351604daa6ffc91dfe28adf7225d ] We can use strnlen() even on early stages and it prevents from going over the string boundaries in case it's already too long. Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Reviewed-by: Kees Cook <redacted> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20231120151419.1661807-3-andriy.shevchenko@linux.intel.com (local) Signed-off-by: Kees Cook <redacted> Stable-dep-of: 3dfaae04243c ("params: fix charp corruption on allocation failure") Signed-off-by: Sasha Levin <sashal@kernel.org> --- kernel/params.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/kernel/params.c b/kernel/params.c
index 9f0f059571a0a..30c0a7388024e 100644
--- a/kernel/params.c
+++ b/kernel/params.c@@ -264,7 +264,10 @@ EXPORT_SYMBOL_GPL(param_set_uint_minmax); int param_set_charp(const char *val, const struct kernel_param *kp) { - if (strlen(val) > 1024) { + size_t len, maxlen = 1024; + + len = strnlen(val, maxlen + 1); + if (len == maxlen + 1) { pr_err("%s: string parameter too long\n", kp->name); return -ENOSPC; }
@@ -274,7 +277,7 @@ int param_set_charp(const char *val, const struct kernel_param *kp) /* This is a hack. We can't kmalloc in early boot, and we * don't need to; this mangled commandline is preserved. */ if (slab_is_available()) { - *(char **)kp->arg = kmalloc_parameter(strlen(val)+1); + *(char **)kp->arg = kmalloc_parameter(len + 1); if (!*(char **)kp->arg) return -ENOMEM; strcpy(*(char **)kp->arg, val);
@@ -512,7 +515,7 @@ int param_set_copystring(const char *val, const struct kernel_param *kp) { const struct kparam_string *kps = kp->str; - if (strlen(val)+1 > kps->maxlen) { + if (strnlen(val, kps->maxlen) == kps->maxlen) { pr_err("%s: string doesn't fit in %u chars.\n", kp->name, kps->maxlen-1); return -ENOSPC;
--
2.53.0