[PATCH 0/8] MIPS: bound early command-line construction

[PATCH 0/8] MIPS: bound early command-line construction

[Pengpeng Hou]

From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sun, 5 Apr 2026 10:20:00 +0800
Subject: [PATCH 0/8] MIPS: bound early command-line construction

These eight fixes harden a set of MIPS early boot paths that build the
kernel command line in fixed-size buffers with unchecked appends.

The affected paths take firmware- or PROM-provided arguments and extend
`arcs_cmdline` or `fw_getcmdline()` with repeated `strcat()`, in-place
`sprintf()`, or equivalent unchecked copies. A long enough firmware
argument set can therefore run past the fixed command-line buffer during
early boot.

This series switches those constructions over to bounded concatenation
while keeping the existing boot-time behavior otherwise unchanged.

Patches:
- 1/8 MIPS: dec: bound PROM command-line appends
- 2/8 MIPS: sni: bound PROM command-line appends
- 3/8 MIPS: lemote-2f: bound machtype command-line append
- 4/8 MIPS: txx9: bound command-line reconstruction
- 5/8 MIPS: arc: bound firmware command-line construction
- 6/8 MIPS: cavium-octeon: bound default console command-line append
- 7/8 MIPS: malta-init: bound default console command-line append
- 8/8 MIPS: malta-setup: bound pci_clock command-line append

Base:
- `origin/master`
- `3aae9383f42f`

Checks:
- all 8 patches apply cleanly to the latest `origin/master`
- `checkpatch --strict` is clean on all 8 exported patch files

Thanks,
Pengpeng

[PATCH 2/8] MIPS: sni: bound PROM command-line appends

[Pengpeng Hou]

prom_init() copies SNI PROM arguments into arcs_cmdline with unchecked
strcat() calls for both the argument text and the separating spaces. A
long enough PROM command line can therefore overflow the fixed kernel
command-line buffer during boot.

Use bounded concatenation for the copied arguments and separators.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/fw/sni/sniprom.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/mips/fw/sni/sniprom.c b/arch/mips/fw/sni/sniprom.c
index 74975e115950..61f4b9f70d30 100644
--- a/arch/mips/fw/sni/sniprom.c
+++ b/arch/mips/fw/sni/sniprom.c
@@ -142,8 +142,12 @@ void __init prom_init(void)
 
 	/* copy prom cmdline parameters to kernel cmdline */
 	for (i = 1; i < argc; i++) {
-		strcat(arcs_cmdline, (char *)CKSEG0ADDR(argv[i]));
-		if (i < (argc - 1))
-			strcat(arcs_cmdline, " ");
+		if (strlcat(arcs_cmdline, (char *)CKSEG0ADDR(argv[i]),
+			    COMMAND_LINE_SIZE) >= COMMAND_LINE_SIZE)
+			break;
+		if (i < (argc - 1) &&
+		    strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE) >=
+		    COMMAND_LINE_SIZE)
+			break;
 	}
 }
-- 
2.50.1 (Apple Git-155)

[PATCH 3/8] MIPS: lemote-2f: bound machtype command-line append

[Pengpeng Hou]

mach_prom_init_machtype() appends the synthesized machtype argument to
the fixed arcs_cmdline buffer with a chain of unchecked strcat() calls.
If the PROM command line is already near full, the extra machtype text
can run past the end of the buffer.

Switch the append steps to bounded concatenation.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/loongson2ef/lemote-2f/machtype.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/mips/loongson2ef/lemote-2f/machtype.c b/arch/mips/loongson2ef/lemote-2f/machtype.c
index 9462a3ab57be..359fe7f826b8 100644
--- a/arch/mips/loongson2ef/lemote-2f/machtype.c
+++ b/arch/mips/loongson2ef/lemote-2f/machtype.c
@@ -34,8 +34,10 @@ void __init mach_prom_init_machtype(void)
 		else
 			mips_machtype = MACH_LEMOTE_NAS;
 
-		strcat(arcs_cmdline, " machtype=");
-		strcat(arcs_cmdline, get_system_type());
-		strcat(arcs_cmdline, " ");
-	}
+		strlcat(arcs_cmdline, " machtype=",
+			COMMAND_LINE_SIZE);
+		strlcat(arcs_cmdline, get_system_type(),
+			COMMAND_LINE_SIZE);
+		strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
+	}
 }
-- 
2.50.1 (Apple Git-155)

[PATCH 1/8] MIPS: dec: bound PROM command-line appends

[Pengpeng Hou]

prom_init_cmdline() appends raw firmware arguments into the fixed
arcs_cmdline buffer with strcat() and adds spaces with another unchecked
strcat(). A long enough argument list can therefore run past the end of
the command-line buffer during early boot.

Switch the appends to bounded concatenation so the PROM argument scan
cannot overflow arcs_cmdline.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/dec/prom/cmdline.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/mips/dec/prom/cmdline.c b/arch/mips/dec/prom/cmdline.c
index 3ed63280ae29..954b14c103d2 100644
--- a/arch/mips/dec/prom/cmdline.c
+++ b/arch/mips/dec/prom/cmdline.c
@@ -29,9 +29,13 @@ void __init prom_init_cmdline(s32 argc, s32 *argv, u32 magic)
 		start_arg = 2;
 	for (i = start_arg; i < argc; i++) {
 		arg = (void *)(long)(argv[i]);
-		strcat(arcs_cmdline, arg);
-		if (i < (argc - 1))
-			strcat(arcs_cmdline, " ");
+		if (strlcat(arcs_cmdline, arg, COMMAND_LINE_SIZE) >=
+		    COMMAND_LINE_SIZE)
+			break;
+		if (i < (argc - 1) &&
+		    strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE) >=
+		    COMMAND_LINE_SIZE)
+			break;
 	}
 
 #ifdef PROM_DEBUG
-- 
2.50.1 (Apple Git-155)

[PATCH 7/8] MIPS: malta-init: bound default console command-line append

[Pengpeng Hou]

console_config() appends a synthesized console= option to fw_getcmdline()
with unchecked strcat() when the firmware command line does not already
provide one. If the existing command line is near full, that append can
overflow the fixed command-line buffer.

Switch the default console append to bounded concatenation.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/mti-malta/malta-init.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/mips/mti-malta/malta-init.c b/arch/mips/mti-malta/malta-init.c
index 82b0fd8576a2..fb782b1a3f6e 100644
--- a/arch/mips/mti-malta/malta-init.c
+++ b/arch/mips/mti-malta/malta-init.c
@@ -78,13 +78,14 @@ static void __init console_config(void)
 		setup_earlycon(console_string);
 	}
 
-	if ((strstr(fw_getcmdline(), "console=")) == NULL) {
-		sprintf(console_string, " console=ttyS0,%d%c%c%c", baud,
-			parity, bits, flow);
-		strcat(fw_getcmdline(), console_string);
-		pr_info("Config serial console:%s\n", console_string);
+	if ((strstr(fw_getcmdline(), "console=")) == NULL) {
+		sprintf(console_string, " console=ttyS0,%d%c%c%c", baud,
+			parity, bits, flow);
+		strlcat(fw_getcmdline(), console_string,
+			COMMAND_LINE_SIZE);
+		pr_info("Config serial console:%s\n", console_string);
+	}
 	}
-}
 #endif
 
 static void __init mips_nmi_setup(void)
-- 
2.50.1 (Apple Git-155)

Re: [PATCH 7/8] MIPS: malta-init: bound default console command-line append

[Sergey Shtylyov]

On 4/4/26 5:06 PM, Pengpeng Hou wrote:

> console_config() appends a synthesized console= option to fw_getcmdline()
> with unchecked strcat() when the firmware command line does not already
> provide one. If the existing command line is near full, that append can
> overflow the fixed command-line buffer.
> 
> Switch the default console append to bounded concatenation.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  arch/mips/mti-malta/malta-init.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/mips/mti-malta/malta-init.c b/arch/mips/mti-malta/malta-init.c
> index 82b0fd8576a2..fb782b1a3f6e 100644
> --- a/arch/mips/mti-malta/malta-init.c
> +++ b/arch/mips/mti-malta/malta-init.c
> @@ -78,13 +78,14 @@ static void __init console_config(void)
>  		setup_earlycon(console_string);
>  	}
>  
> -	if ((strstr(fw_getcmdline(), "console=")) == NULL) {
> -		sprintf(console_string, " console=ttyS0,%d%c%c%c", baud,
> -			parity, bits, flow);
> -		strcat(fw_getcmdline(), console_string);
> -		pr_info("Config serial console:%s\n", console_string);
> +	if ((strstr(fw_getcmdline(), "console=")) == NULL) {
> +		sprintf(console_string, " console=ttyS0,%d%c%c%c", baud,
> +			parity, bits, flow);

   I don't quit understand what changed in the above 3 lines...

> +		strlcat(fw_getcmdline(), console_string,
> +			COMMAND_LINE_SIZE);
> +		pr_info("Config serial console:%s\n", console_string);
> +	}
>  	}
> -}

   Huh? :-)

>  #endif

MBR, Sergey

Re: [PATCH 7/8] MIPS: malta-init: bound default console command-line append

[Pengpeng Hou]

Hi Sergey,

Thanks, you're right.

There is no intended control-flow change here. The only intended
functional change in this hunk is replacing the unchecked

  strcat(fw_getcmdline(), console_string);

with a bounded append.

The surrounding brace movement is accidental diff noise, and it makes the
patch much harder to read than it should be. I will clean this up in the
next revision so the hunk only shows the actual append change.

Thanks,
Pengpeng

[PATCH 8/8] MIPS: malta-setup: bound pci_clock command-line append

[Pengpeng Hou]

pci_clock_check() appends a synthesized pci_clock= option by advancing to
the end of fw_getcmdline() and calling sprintf() in place. If the command
line is already near full, that write can run past the fixed boot
command-line buffer.

Format the option into a small temporary buffer and append it with
bounded concatenation instead.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/mti-malta/malta-setup.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/mips/mti-malta/malta-setup.c b/arch/mips/mti-malta/malta-setup.c
index 816570514c37..07c9f1b9bed7 100644
--- a/arch/mips/mti-malta/malta-setup.c
+++ b/arch/mips/mti-malta/malta-setup.c
@@ -148,10 +148,12 @@ static void __init pci_clock_check(void)
 		return;
 
 	if (pciclock != 33) {
+		char arg[24];
+
 		pr_warn("WARNING: PCI clock is %dMHz, setting pci_clock\n",
 			pciclock);
-		argptr += strlen(argptr);
-		sprintf(argptr, " pci_clock=%d", pciclock);
+		snprintf(arg, sizeof(arg), " pci_clock=%d", pciclock);
+		strlcat(argptr, arg, COMMAND_LINE_SIZE);
 		if (pciclock < 20 || pciclock > 66)
 			pr_warn("WARNING: IDE timing calculations will be "
 			        "incorrect\n");
-- 
2.50.1 (Apple Git-155)

[PATCH 6/8] MIPS: cavium-octeon: bound default console command-line append

[Pengpeng Hou]

setup_octeon_cmdline() already bounds most copied firmware arguments,
but the fallback default console append still uses unchecked strcat(). If
the command line is already near the end of the fixed buffer, the default
console string can run past the buffer boundary.

Use bounded concatenation for the default console fallback.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/cavium-octeon/setup.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index 1ad2602a0383..87f34bc20896 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -898,9 +898,11 @@ void __init prom_init(void)
 
 	if (strstr(arcs_cmdline, "console=") == NULL) {
 		if (octeon_uart == 1)
-			strcat(arcs_cmdline, " console=ttyS1,115200");
+			strlcat(arcs_cmdline, " console=ttyS1,115200",
+				COMMAND_LINE_SIZE);
 		else
-			strcat(arcs_cmdline, " console=ttyS0,115200");
+			strlcat(arcs_cmdline, " console=ttyS0,115200",
+				COMMAND_LINE_SIZE);
 	}
 
 	mips_hpt_frequency = octeon_get_clock_rate();
-- 
2.50.1 (Apple Git-155)

[PATCH 5/8] MIPS: arc: bound firmware command-line construction

[Pengpeng Hou]

The ARC PROM command-line path appends translated firmware variables and
raw arguments into arcs_cmdline with unchecked pointer arithmetic and
memcpy(). A long enough firmware argument set can overrun the fixed
kernel command-line buffer before boot completes.

Use bounded concatenation for both the rewritten ARC variables and the
remaining PROM arguments.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/fw/arc/cmdline.c | 23 +++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/arch/mips/fw/arc/cmdline.c b/arch/mips/fw/arc/cmdline.c
index 86b0e377b713..d66a6b8216f2 100644
--- a/arch/mips/fw/arc/cmdline.c
+++ b/arch/mips/fw/arc/cmdline.c
@@ -51,18 +51,20 @@
 			len = strlen(used_arc[i][0]);
 
 			if (!strncmp(prom_argv(actr), used_arc[i][0], len)) {
-			/* Ok, we want it. First append the replacement... */
-				strcat(cp, used_arc[i][1]);
-				cp += strlen(used_arc[i][1]);
+				/* Ok, we want it. First append the replacement... */
+				strlcat(arcs_cmdline, used_arc[i][1],
+					COMMAND_LINE_SIZE);
+				cp = arcs_cmdline + strlen(arcs_cmdline);
 				/* ... and now the argument */
 				s = strchr(prom_argv(actr), '=');
 				if (s) {
 					s++;
-					len = strlen(s);
-					memcpy(cp, s, len + 1);
-					cp += len;
+					strlcat(arcs_cmdline, s,
+						COMMAND_LINE_SIZE);
+					cp = arcs_cmdline + strlen(arcs_cmdline);
 				}
-				*cp++ = ' ';
+				strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
+				cp = arcs_cmdline + strlen(arcs_cmdline);
 				break;
 			}
 		}
@@ -95,10 +97,9 @@
 		}
 
 		/* Ok, we want it. */
-		len = strlen(prom_argv(actr));
-		memcpy(cp, prom_argv(actr), len + 1);
-		cp += len;
-		*cp++ = ' ';
+		strlcat(arcs_cmdline, prom_argv(actr), COMMAND_LINE_SIZE);
+		strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
+		cp = arcs_cmdline + strlen(arcs_cmdline);
 
 	pic_cont:
 		actr++;
-- 
2.50.1 (Apple Git-155)

[PATCH 4/8] MIPS: txx9: bound command-line reconstruction

[Pengpeng Hou]

The early txx9 command-line builders rebuild arcs_cmdline with repeated
strcat() calls when quoting PROM arguments and when reinserting filtered
arguments after preprocessing. Those append chains do not track the
remaining space in the fixed command-line buffer.

Convert the rebuild steps to bounded concatenation so long firmware
arguments cannot overflow arcs_cmdline.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/mips/txx9/generic/setup.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
index 6c5025806914..715059d5101e 100644
--- a/arch/mips/txx9/generic/setup.c
+++ b/arch/mips/txx9/generic/setup.c
@@ -128,13 +128,13 @@ static void __init prom_init_cmdline(void)
 	for (i = 1; i < argc; i++) {
 		char *str = (char *)(long)argv32[i];
 		if (i != 1)
-			strcat(arcs_cmdline, " ");
+			strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
 		if (strchr(str, ' ')) {
-			strcat(arcs_cmdline, "\"");
-			strcat(arcs_cmdline, str);
-			strcat(arcs_cmdline, "\"");
+			strlcat(arcs_cmdline, "\"", COMMAND_LINE_SIZE);
+			strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
+			strlcat(arcs_cmdline, "\"", COMMAND_LINE_SIZE);
 		} else
-			strcat(arcs_cmdline, str);
+			strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
 	}
 }
 
@@ -227,8 +227,8 @@ static void __init preprocess_cmdline(void)
 			continue;
 		}
 		if (arcs_cmdline[0])
-			strcat(arcs_cmdline, " ");
-		strcat(arcs_cmdline, str);
+			strlcat(arcs_cmdline, " ", COMMAND_LINE_SIZE);
+		strlcat(arcs_cmdline, str, COMMAND_LINE_SIZE);
 	}
 
 	txx9_cache_fixup();
-- 
2.50.1 (Apple Git-155)