320-harden-fw_init_cmdline.patch 1.2 KB

1234567891011121314151617181920212223242526272829303132333435363738
  1. From e813f48461b8011244b3e7dfe118cf94fd595f0d Mon Sep 17 00:00:00 2001
  2. From: Markus Stockhausen <[email protected]>
  3. Date: Sun, 25 Aug 2024 13:09:48 -0400
  4. Subject: [PATCH] realtek: harden fw_init_cmdline()
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Some devices (e.g. HP JG924A) hand over other than expected kernel boot
  9. arguments. Looking at these one can see:
  10. fw_init_cmdline: fw_arg0=00020000
  11. fw_init_cmdline: fw_arg1=00060000
  12. fw_init_cmdline: fw_arg2=fffdffff
  13. fw_init_cmdline: fw_arg3=0000416c
  14. Especially fw_arg2 should be the pointer to the environment and it looks
  15. very suspicous. It is not aligned and the address is outside KSEG0 and
  16. KSEG1. Booting the device will result in a hang. Do better at verifying
  17. the address.
  18. Signed-off-by: Bjørn Mork <[email protected]>
  19. Signed-off-by: Markus Stockhausen <[email protected]>
  20. ---
  21. arch/mips/fw/lib/cmdline.c | 2 +-
  22. 1 file changed, 1 insertion(+), 1 deletion(-)
  23. --- a/arch/mips/fw/lib/cmdline.c
  24. +++ b/arch/mips/fw/lib/cmdline.c
  25. @@ -31,7 +31,7 @@ void __init fw_init_cmdline(void)
  26. }
  27. /* Validate environment pointer. */
  28. - if (fw_arg2 < CKSEG0)
  29. + if (fw_arg2 < CKSEG0 || fw_arg2 >= CKSEG2)
  30. _fw_envp = NULL;
  31. else
  32. _fw_envp = (int *)fw_arg2;