[PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[Thorsten Blum]

Replace simple_strtoull() with boot_kstrtoul() for parsing the
hugepages= boot parameter.

Unlike simple_strtoull(), boot_kstrtoul() performs strict validation and
returns an error on invalid inputs instead of silently accepting partial
input. Use boot_kstrtoul() to reject and warn about invalid hugepages=
values.

boot_kstrtoul() also converts the input directly to an unsigned long and
avoids implicit casting.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
Changes in v2:
- Adjust warning message (Boris)
- The value pointer cannot be NULL after [1] has been applied (Boris)
- Update patch subject and description
- Link to v1: https://lore.kernel.org/lkml/20260202173223.865709-1-thorsten.blum@linux.dev/

[1] https://lore.kernel.org/lkml/20260409105437.108686-4-thorsten.blum@linux.dev/
---
 arch/x86/boot/compressed/kaslr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 3b0948ad449f..8e4bf5365ac6 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -219,7 +219,8 @@ static void parse_gb_huge_pages(char *param, char *val)
 
 	if (!strcmp(param, "hugepages") && gbpage_sz) {
 		p = val;
-		max_gb_huge_pages = simple_strtoull(p, &p, 0);
+		if (boot_kstrtoul(p, 0, &max_gb_huge_pages))
+			warn("Failed to parse hugepages= boot parameter\n");
 		return;
 	}
 }

Re: [PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[Thorsten Blum]

On Thu, Apr 09, 2026 at 06:15:59PM +0200, Thorsten Blum wrote:
> Replace simple_strtoull() with boot_kstrtoul() for parsing the
> hugepages= boot parameter.
> 
> Unlike simple_strtoull(), boot_kstrtoul() performs strict validation and
> returns an error on invalid inputs instead of silently accepting partial
> input. Use boot_kstrtoul() to reject and warn about invalid hugepages=
> values.
> 
> boot_kstrtoul() also converts the input directly to an unsigned long and
> avoids implicit casting.
> 
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
> Changes in v2:
> - Adjust warning message (Boris)
> - The value pointer cannot be NULL after [1] has been applied (Boris)
> - Update patch subject and description
> - Link to v1: https://lore.kernel.org/lkml/20260202173223.865709-1-thorsten.blum@linux.dev/
> 
> [1] https://lore.kernel.org/lkml/20260409105437.108686-4-thorsten.blum@linux.dev/
> ---
>  arch/x86/boot/compressed/kaslr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> index 3b0948ad449f..8e4bf5365ac6 100644
> --- a/arch/x86/boot/compressed/kaslr.c
> +++ b/arch/x86/boot/compressed/kaslr.c
> @@ -219,7 +219,8 @@ static void parse_gb_huge_pages(char *param, char *val)
>  
>  	if (!strcmp(param, "hugepages") && gbpage_sz) {
>  		p = val;
> -		max_gb_huge_pages = simple_strtoull(p, &p, 0);
> +		if (boot_kstrtoul(p, 0, &max_gb_huge_pages))
> +			warn("Failed to parse hugepages= boot parameter\n");
>  		return;
>  	}
>  }

Hi Boris,

Could you give this another look now that [1] is in mainline and 'val'
can no longer be NULL?

Thanks,
Thorsten

Re: [PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[Borislav Petkov]

On Mon, Apr 27, 2026 at 10:17:58AM +0200, Thorsten Blum wrote:
> Could you give this another look now that [1] is in mainline and 'val'
> can no longer be NULL?

I did but looking at arch/x86/boot/string.c - we have kstrtoull() - notice the
two "ll" - there already because we copied it from kernel proper.

So, I'm thinking you should rename it to boot_kstrtoull() in a pre-patch and
then use it in kaslr.c.

Right?

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[Thorsten Blum]

On Mon, May 04, 2026 at 12:14:39PM +0200, Borislav Petkov wrote:
> On Mon, Apr 27, 2026 at 10:17:58AM +0200, Thorsten Blum wrote:
> > Could you give this another look now that [1] is in mainline and 'val'
> > can no longer be NULL?
> 
> I did but looking at arch/x86/boot/string.c - we have kstrtoull() - notice the
> two "ll" - there already because we copied it from kernel proper.
> 
> So, I'm thinking you should rename it to boot_kstrtoull() in a pre-patch and
> then use it in kaslr.c.
> 
> Right?

Keep in mind that max_gb_huge_pages is an unsigned long (not ull), so I
think boot_kstrtoul() is the better fit.

The last sentence in my commit message also mentions that
boot_kstrtoul() avoids casting the parsed value from ull to ul.

Thanks,
Thorsten

Re: [PATCH v2] x86/boot/compressed: use boot_kstrtoul() for hugepages= parsing

[Borislav Petkov]

On Mon, May 04, 2026 at 12:27:50PM +0200, Thorsten Blum wrote:
> Keep in mind that max_gb_huge_pages is an unsigned long (not ull), so I
> think boot_kstrtoul() is the better fit.
> 
> The last sentence in my commit message also mentions that
> boot_kstrtoul() avoids casting the parsed value from ull to ul.

Bah, what a mess that code is...

Ok, lemme apply it as is.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

[tip: x86/cleanups] x86/boot/compressed: Use boot_kstrtoul() for hugepages= parsing

[tip-bot2 for Thorsten Blum]

The following commit has been merged into the x86/cleanups branch of tip:

Commit-ID:     7b894dac26e56eb1de7a8e198af4b994c5d6da82
Gitweb:        https://git.kernel.org/tip/7b894dac26e56eb1de7a8e198af4b994c5d6da82
Author:        Thorsten Blum <thorsten.blum@linux.dev>
AuthorDate:    Thu, 09 Apr 2026 18:15:59 +02:00
Committer:     Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Mon, 04 May 2026 14:16:11 +02:00

x86/boot/compressed: Use boot_kstrtoul() for hugepages= parsing

Replace simple_strtoull() with boot_kstrtoul() for parsing the hugepages= boot
parameter.

Unlike simple_strtoull(), boot_kstrtoul() performs strict validation and
returns an error on invalid inputs instead of silently accepting partial
input. Use boot_kstrtoul() to reject and warn about invalid hugepages= values.

boot_kstrtoul() also converts the input directly to an unsigned long and
avoids implicit casting as max_gb_huge_pages *is* an unsigned long.

  [ bp: Massage commit message. ]

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260409161600.152012-2-thorsten.blum@linux.dev
---
 arch/x86/boot/compressed/kaslr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 3b0948a..8e4bf53 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -219,7 +219,8 @@ static void parse_gb_huge_pages(char *param, char *val)
 
 	if (!strcmp(param, "hugepages") && gbpage_sz) {
 		p = val;
-		max_gb_huge_pages = simple_strtoull(p, &p, 0);
+		if (boot_kstrtoul(p, 0, &max_gb_huge_pages))
+			warn("Failed to parse hugepages= boot parameter\n");
 		return;
 	}
 }