[PATCH 1/1] init/version.c: fix NULL pointer dereference on bare "hostname" param

[PATCH 1/1] init/version.c: fix NULL pointer dereference on bare "hostname" param

[Michael Prokop]

early_hostname() passes its "arg" parameter straight to strscpy()
without checking it for NULL. As a result, a bare "hostname" (no
"=value") on the kernel command line calls early_hostname(NULL),
which dereferences a NULL pointer.

This happens during parse_early_param(), before console_init(), so the
kernel oopses with no visible output on the usual boot console and the
system fails to boot.

STR:

  make x86_64_defconfig
  ./scripts/kconfig/merge_config.sh -m .config kernel/configs/kvm_guest.config
  make olddefconfig
  make bzImage
  qemu-system-x86_64 -kernel arch/x86/boot/bzImage \
    -nographic -no-reboot -m 512M -append \
    "earlyprintk=ttyS0 earlycon=uart8250,io,0x3f8,115200n8 ignore_loglevel console=ttyS0 hostname"

Resulting in:

[    0.000000] CR2: 0000000000000000 CR3: 0000000010d82000 CR4: 00000000000000b0
[    0.000000] Call Trace:
[    0.000000] Call Trace:
[    0.000000]  <TASK>
[    0.000000]  <TASK>
[    0.000000]  ? early_hostname+0x18/0x40
[    0.000000]  ? early_hostname+0x18/0x40
[    0.000000]  ? do_early_param+0x3f/0x70
[    0.000000]  ? do_early_param+0x3f/0x70
[    0.000000]  ? parse_args+0x15d/0x3c0
[    0.000000]  ? parse_args+0x15d/0x3c0
[    0.000000]  ? __pfx_do_early_param+0x10/0x10
[    0.000000]  ? __pfx_do_early_param+0x10/0x10
[    0.000000]  ? parse_early_options+0x24/0x30
[    0.000000]  ? parse_early_options+0x24/0x30
[    0.000000]  ? __pfx_do_early_param+0x10/0x10
[    0.000000]  ? __pfx_do_early_param+0x10/0x10
[    0.000000]  ? parse_early_param+0x31/0x80
[    0.000000]  ? parse_early_param+0x31/0x80
[    0.000000]  ? setup_arch+0x46b/0xab0
[    0.000000]  ? setup_arch+0x46b/0xab0
[    0.000000]  ? _printk+0x66/0x80
[    0.000000]  ? _printk+0x66/0x80
[    0.000000]  ? start_kernel+0x58/0x780
[    0.000000]  ? start_kernel+0x58/0x780
[    0.000000]  ? x86_64_start_reservations+0x24/0x30
[    0.000000]  ? x86_64_start_reservations+0x24/0x30
[    0.000000]  ? x86_64_start_kernel+0xce/0xd0
[    0.000000]  ? x86_64_start_kernel+0xce/0xd0
[    0.000000]  ? common_startup_64+0x13e/0x158
[    0.000000]  ? common_startup_64+0x13e/0x158
[    0.000000]  </TASK>
[    0.000000]  </TASK>

Fixes: 5a704629f2c1 ("init: add "hostname" kernel parameter")
Signed-off-by: Michael Prokop <mika@grml.org>
---
 init/version.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/init/version.c b/init/version.c
index 94c96f6fbfe6..0bd5c45aabc4 100644
--- a/init/version.c
+++ b/init/version.c
@@ -23,6 +23,9 @@ static int __init early_hostname(char *arg)
 	size_t maxlen  = bufsize - 1;
 	ssize_t arglen;
 
+	if (!arg)
+		return -EINVAL;
+
 	arglen = strscpy(init_uts_ns.name.nodename, arg, bufsize);
 	if (arglen < 0) {
 		pr_warn("hostname parameter exceeds %zd characters and will be truncated",
-- 
2.50.1