On Mon, Jun 09, 2014 at 10:11:22AM +0800, Dave Young wrote: [..] > > > > + image->cmdline_buf = vzalloc(cmdline_len); > > > > > > You should validate the upper/lower boundary of cmdline_len before > > > calling vzalloc. When cmdline_len is 0 or too large, vmalloc failure > > > message would be fired. > > > > What's the upper length of vzalloc(). I think if it is too big to alloc, > > then vzalloc() should return me an error? > > function __vmalloc_node_range: > if (!size || (size >> PAGE_SHIFT) > totalram_pages) > goto fail; > > So I think only checking cmdline_len == 0 is enough. > > For the upper length shouldn't it be stripped to COMMAND_LINE_SIZE? We might be booting a newer kernel supporting bigger command line size as compared to running kernel. So we query bzImage header to figure out what's the maximum command line length supported. Just that currently that check happens later during image load time. Thanks Vivek
