[tip: x86/urgent] x86/boot: Reject too long acpi_rsdp= values

[tip-bot2 for Thorsten Blum]

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     d130041a7b96f79cd4c7079a6c2431a6db4c9619
Gitweb:        https://git.kernel.org/tip/d130041a7b96f79cd4c7079a6c2431a6db4c9619
Author:        Thorsten Blum <thorsten.blum@xxxxxxxxx>
AuthorDate:    Sun, 21 Jun 2026 19:00:10 +02:00
Committer:     Borislav Petkov (AMD) <bp@xxxxxxxxx>
CommitterDate: Sat, 11 Jul 2026 19:25:26 -07:00

x86/boot: Reject too long acpi_rsdp= values

cmdline_find_option() returns the full length of the parsed acpi_rsdp=
value. get_cmdline_acpi_rsdp() then silently truncates values which do
not fit in the val[] buffer.

Prevent boot_kstrtoul() from parsing a truncated value and then the
kernel from silently using the wrong RSDP address, see discussion in
Link:.

Issue a warning so that the user is aware that s/he supplied a malformed
value and can get feedback instead of silent crashes.

  [ bp: Make commit message more precise. ]

Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
Signed-off-by: Thorsten Blum <thorsten.blum@xxxxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@xxxxxxxxx
---
 arch/x86/boot/compressed/acpi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/acpi.c b/arch/x86/boot/compressed/acpi.c
index f196b1d..aed2760 100644
--- a/arch/x86/boot/compressed/acpi.c
+++ b/arch/x86/boot/compressed/acpi.c
@@ -184,10 +184,15 @@ static unsigned long get_cmdline_acpi_rsdp(void)
 	char val[MAX_ADDR_LEN] = { };
 	int ret;
 
-	ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
+	ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
 	if (ret < 0)
 		return 0;
 
+	if (ret >= sizeof(val)) {
+		warn("acpi_rsdp= value too long; ignoring");
+		return 0;
+	}
+
 	if (boot_kstrtoul(val, 16, &addr))
 		return 0;
 #endif