[merged mm-nonmm-stable] init-main-fix-false-positive-kernel-panic-on-environment-variable-overwrite.patch removed from -mm tree

[merged mm-nonmm-stable] init-main-fix-false-positive-kernel-panic-on-environment-variable-overwrite.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: init/main: fix false-positive kernel panic on environment variable overwrite
has been removed from the -mm tree.  Its filename was
     init-main-fix-false-positive-kernel-panic-on-environment-variable-overwrite.patch

This patch was dropped because it was merged into the mm-nonmm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Wilson Felipe Pereira <wfelipe@google.com>
Subject: init/main: fix false-positive kernel panic on environment variable overwrite
Date: Tue, 18 Aug 2026 04:53:47 +0000

In unknown_bootoption(), the limit checking for environment variables sets
panic_later *before* checking if the variable already exists in envp_init.

If a user passes exactly MAX_INIT_ENVS custom variables and then
overwrites the final variable by matching its key, it causes a
false-positive hard panic on boot despite not actually exceeding the array
bounds or increasing the total variable count.

Swapping the order of these checks allows the duplicate check to break out
of the loop before the panic flag is erroneously latched.

To verify, boot a VM with 31 custom variables (filling the array up to its
limit of 32) and then overwrite the very last variable:

  ENV_VARS=$(for i in {1..31}; do echo -n "var$i=$i "; done)
  qemu-system-x86_64 -kernel bzImage -append "$ENV_VARS var31=overwrite"

Without this patch, the kernel crashes instantly with:
  Kernel panic - not syncing: Too many boot env vars at 'var31=overwrite'

With this patch, the kernel safely overwrites the variable and boots.

Link: https://lore.kernel.org/20260818045357.4123784-3-wfelipe@google.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Wilson Felipe Pereira <wfelipe@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 init/main.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/init/main.c~init-main-fix-false-positive-kernel-panic-on-environment-variable-overwrite
+++ a/init/main.c
@@ -548,12 +548,12 @@ static int __init unknown_bootoption(cha
 		/* Environment option */
 		unsigned int i;
 		for (i = 0; envp_init[i]; i++) {
+			if (!strncmp(param, envp_init[i], len+1))
+				break;
 			if (i == MAX_INIT_ENVS) {
 				panic_later = "env";
 				panic_param = param;
 			}
-			if (!strncmp(param, envp_init[i], len+1))
-				break;
 		}
 		envp_init[i] = param;
 	} else {
_

Patches currently in -mm which might be from wfelipe@google.com are

mm-zswap-convert-zswap_store_page-and-zswap_compress-to-take-a-folio.patch