Blame SOURCES/0332-verifiers-Add-possibility-to-verify-kernel-and-modul.patch

3efed6
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
3efed6
From: Vladimir Serbinenko <phcoder@gmail.com>
3efed6
Date: Tue, 7 Feb 2017 02:10:14 +0100
3efed6
Subject: [PATCH] verifiers: Add possibility to verify kernel and modules
3efed6
 command lines
3efed6
3efed6
Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com>
3efed6
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
3efed6
Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
3efed6
(backported from 4d4a8c96e3593d76fe7b025665ccdecc70a53c1f)
3efed6
Signed-off-by: Daniel Axtens <dja@axtens.net>
3efed6
---
3efed6
 grub-core/commands/verifiers.c            | 14 ++++++++++++++
3efed6
 grub-core/lib/cmdline.c                   |  7 ++++---
3efed6
 grub-core/loader/arm/linux.c              |  8 ++++++--
3efed6
 grub-core/loader/arm64/linux.c            | 10 +++++++---
3efed6
 grub-core/loader/i386/bsd.c               |  6 ++++++
3efed6
 grub-core/loader/i386/linux.c             | 16 +++++++++++-----
3efed6
 grub-core/loader/i386/multiboot_mbi.c     | 16 ++++++++++------
3efed6
 grub-core/loader/i386/pc/linux.c          | 13 ++++++++-----
3efed6
 grub-core/loader/i386/pc/plan9.c          | 11 +++++++++++
3efed6
 grub-core/loader/i386/xen.c               |  7 +++++++
3efed6
 grub-core/loader/ia64/efi/linux.c         |  7 +++++++
3efed6
 grub-core/loader/mips/linux.c             |  8 ++++++++
3efed6
 grub-core/loader/multiboot_mbi2.c         |  8 +++-----
3efed6
 grub-core/loader/powerpc/ieee1275/linux.c |  5 +++--
3efed6
 grub-core/loader/sparc64/ieee1275/linux.c |  5 +++--
3efed6
 grub-core/loader/xnu.c                    |  9 +++++++++
3efed6
 include/grub/lib/cmdline.h                |  5 +++--
3efed6
 include/grub/verify.h                     | 11 +++++++++++
3efed6
 18 files changed, 131 insertions(+), 35 deletions(-)
3efed6
3efed6
diff --git a/grub-core/commands/verifiers.c b/grub-core/commands/verifiers.c
b71686
index fde88318d..59ea418a2 100644
3efed6
--- a/grub-core/commands/verifiers.c
3efed6
+++ b/grub-core/commands/verifiers.c
3efed6
@@ -186,6 +186,20 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type)
3efed6
   return NULL;
3efed6
 }
3efed6
 
3efed6
+grub_err_t
3efed6
+grub_verify_string (char *str, enum grub_verify_string_type type)
3efed6
+{
3efed6
+  struct grub_file_verifier *ver;
3efed6
+  FOR_LIST_ELEMENTS(ver, grub_file_verifiers)
3efed6
+    {
3efed6
+      grub_err_t err;
3efed6
+      err = ver->verify_string ? ver->verify_string (str, type) : GRUB_ERR_NONE;
3efed6
+      if (err)
3efed6
+	return err;
3efed6
+    }
3efed6
+  return GRUB_ERR_NONE;
3efed6
+}
3efed6
+
3efed6
 GRUB_MOD_INIT(verifiers)
3efed6
 {
3efed6
   grub_file_filter_register (GRUB_FILE_FILTER_VERIFY, grub_verifiers_open);
3efed6
diff --git a/grub-core/lib/cmdline.c b/grub-core/lib/cmdline.c
b71686
index d5c12957c..463c3c65c 100644
3efed6
--- a/grub-core/lib/cmdline.c
3efed6
+++ b/grub-core/lib/cmdline.c
3efed6
@@ -75,8 +75,9 @@ unsigned int grub_loader_cmdline_size (int argc, char *argv[])
3efed6
   return size;
3efed6
 }
3efed6
 
3efed6
-int grub_create_loader_cmdline (int argc, char *argv[], char *buf,
3efed6
-				grub_size_t size)
3efed6
+grub_err_t
3efed6
+grub_create_loader_cmdline (int argc, char *argv[], char *buf,
3efed6
+			    grub_size_t size, enum grub_verify_string_type type)
3efed6
 {
3efed6
   int i, space;
3efed6
   unsigned int arg_size;
3efed6
@@ -130,5 +131,5 @@ int grub_create_loader_cmdline (int argc, char *argv[], char *buf,
3efed6
 		    "grub_kernel_cmdline", orig);
3efed6
   grub_print_error();
3efed6
 
3efed6
-  return i;
3efed6
+  return grub_verify_string (orig, type);
3efed6
 }
3efed6
diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
b71686
index ea29d7a72..beceda520 100644
3efed6
--- a/grub-core/loader/arm/linux.c
3efed6
+++ b/grub-core/loader/arm/linux.c
3efed6
@@ -28,6 +28,7 @@
3efed6
 #include <grub/cpu/linux.h>
3efed6
 #include <grub/lib/cmdline.h>
3efed6
 #include <grub/linux.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -383,8 +384,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
 
3efed6
   /* Create kernel command line.  */
3efed6
   grub_memcpy (linux_args, LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv,
3efed6
-			      linux_args + sizeof (LINUX_IMAGE) - 1, size);
3efed6
+  err = grub_create_loader_cmdline (argc, argv,
3efed6
+				    linux_args + sizeof (LINUX_IMAGE) - 1, size,
3efed6
+				    GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    goto fail;
3efed6
 
3efed6
   return GRUB_ERR_NONE;
3efed6
 
3efed6
diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
b71686
index 7a076c131..48ea66596 100644
3efed6
--- a/grub-core/loader/arm64/linux.c
3efed6
+++ b/grub-core/loader/arm64/linux.c
3efed6
@@ -33,6 +33,7 @@
3efed6
 #include <grub/efi/pe32.h>
3efed6
 #include <grub/i18n.h>
3efed6
 #include <grub/lib/cmdline.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -403,9 +404,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
       goto fail;
3efed6
     }
3efed6
   grub_memcpy (linux_args, LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv,
3efed6
-			      linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
-			      cmdline_size);
3efed6
+  err = grub_create_loader_cmdline (argc, argv,
3efed6
+				    linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
+				    cmdline_size,
3efed6
+				    GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    goto fail;
3efed6
 
3efed6
   if (grub_errno == GRUB_ERR_NONE)
3efed6
     {
3efed6
diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
b71686
index 8306b415a..45a715099 100644
3efed6
--- a/grub-core/loader/i386/bsd.c
3efed6
+++ b/grub-core/loader/i386/bsd.c
3efed6
@@ -36,6 +36,7 @@
3efed6
 #include <grub/bsdlabel.h>
3efed6
 #include <grub/crypto.h>
3efed6
 #include <grub/safemath.h>
3efed6
+#include <grub/verify.h>
3efed6
 #ifdef GRUB_MACHINE_PCBIOS
3efed6
 #include <grub/machine/int.h>
3efed6
 #endif
3efed6
@@ -418,6 +419,8 @@ grub_freebsd_add_meta_module (const char *filename, const char *type,
3efed6
 			      grub_addr_t addr, grub_uint32_t size)
3efed6
 {
3efed6
   const char *name;
3efed6
+  grub_err_t err;
3efed6
+
3efed6
   name = grub_strrchr (filename, '/');
3efed6
   if (name)
3efed6
     name++;
3efed6
@@ -471,6 +474,9 @@ grub_freebsd_add_meta_module (const char *filename, const char *type,
3efed6
 	      *(p++) = ' ';
3efed6
 	    }
3efed6
 	  *p = 0;
3efed6
+	  err = grub_verify_string (cmdline, GRUB_VERIFY_MODULE_CMDLINE);
3efed6
+	  if (err)
3efed6
+	    return err;
3efed6
 	}
3efed6
     }
3efed6
 
3efed6
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
b71686
index aa2cbc4e7..ef8fcb9e1 100644
3efed6
--- a/grub-core/loader/i386/linux.c
3efed6
+++ b/grub-core/loader/i386/linux.c
3efed6
@@ -1039,11 +1039,17 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
   if (!linux_cmdline)
3efed6
     goto fail;
3efed6
   grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv,
3efed6
-			      linux_cmdline
3efed6
-			      + sizeof (LINUX_IMAGE) - 1,
3efed6
-			      maximal_cmdline_size
3efed6
-			      - (sizeof (LINUX_IMAGE) - 1));
3efed6
+  {
3efed6
+    grub_err_t err;
3efed6
+    err = grub_create_loader_cmdline (argc, argv,
3efed6
+				      linux_cmdline
3efed6
+				      + sizeof (LINUX_IMAGE) - 1,
3efed6
+				      maximal_cmdline_size
3efed6
+				      - (sizeof (LINUX_IMAGE) - 1),
3efed6
+				      GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+    if (err)
3efed6
+      goto fail;
3efed6
+  }
3efed6
 
3efed6
   len = prot_file_size;
3efed6
   grub_memcpy (prot_mode_mem, kernel + kernel_offset, len);
3efed6
diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c
b71686
index 9d3466d6a..525446b56 100644
3efed6
--- a/grub-core/loader/i386/multiboot_mbi.c
3efed6
+++ b/grub-core/loader/i386/multiboot_mbi.c
3efed6
@@ -676,10 +676,8 @@ grub_multiboot_init_mbi (int argc, char *argv[])
3efed6
     return grub_errno;
3efed6
   cmdline_size = len;
3efed6
 
3efed6
-  grub_create_loader_cmdline (argc, argv, cmdline,
3efed6
-			      cmdline_size);
3efed6
-
3efed6
-  return GRUB_ERR_NONE;
3efed6
+  return grub_create_loader_cmdline (argc, argv, cmdline,
3efed6
+				     cmdline_size, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
 }
3efed6
 
3efed6
 grub_err_t
3efed6
@@ -688,6 +686,7 @@ grub_multiboot_add_module (grub_addr_t start, grub_size_t size,
3efed6
 {
3efed6
   struct module *newmod;
3efed6
   grub_size_t len = 0;
3efed6
+  grub_err_t err;
3efed6
 
3efed6
   newmod = grub_malloc (sizeof (*newmod));
3efed6
   if (!newmod)
3efed6
@@ -707,8 +706,13 @@ grub_multiboot_add_module (grub_addr_t start, grub_size_t size,
3efed6
   newmod->cmdline_size = len;
3efed6
   total_modcmd += ALIGN_UP (len, 4);
3efed6
 
3efed6
-  grub_create_loader_cmdline (argc, argv, newmod->cmdline,
3efed6
-			      newmod->cmdline_size);
3efed6
+  err = grub_create_loader_cmdline (argc, argv, newmod->cmdline,
3efed6
+				    newmod->cmdline_size, GRUB_VERIFY_MODULE_CMDLINE);
3efed6
+  if (err)
3efed6
+    {
3efed6
+      grub_free (newmod);
3efed6
+      return grub_errno;
3efed6
+    }
3efed6
 
3efed6
   if (modules_last)
3efed6
     modules_last->next = newmod;
3efed6
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
b71686
index b5c28c658..f631225f5 100644
3efed6
--- a/grub-core/loader/i386/pc/linux.c
3efed6
+++ b/grub-core/loader/i386/pc/linux.c
3efed6
@@ -348,11 +348,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
   /* Create kernel command line.  */
3efed6
   grub_memcpy ((char *)grub_linux_real_chunk + GRUB_LINUX_CL_OFFSET,
3efed6
 		LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv,
3efed6
-			      (char *)grub_linux_real_chunk
3efed6
-			      + GRUB_LINUX_CL_OFFSET + sizeof (LINUX_IMAGE) - 1,
3efed6
-			      maximal_cmdline_size
3efed6
-			      - (sizeof (LINUX_IMAGE) - 1));
3efed6
+  err = grub_create_loader_cmdline (argc, argv,
3efed6
+				    (char *)grub_linux_real_chunk
3efed6
+				    + GRUB_LINUX_CL_OFFSET + sizeof (LINUX_IMAGE) - 1,
3efed6
+				    maximal_cmdline_size
3efed6
+				    - (sizeof (LINUX_IMAGE) - 1),
3efed6
+				    GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    goto fail;
3efed6
 
3efed6
   if (grub_linux_is_bzimage)
3efed6
     grub_linux_prot_target = GRUB_LINUX_BZIMAGE_ADDR;
3efed6
diff --git a/grub-core/loader/i386/pc/plan9.c b/grub-core/loader/i386/pc/plan9.c
b71686
index 0351090da..37550155d 100644
3efed6
--- a/grub-core/loader/i386/pc/plan9.c
3efed6
+++ b/grub-core/loader/i386/pc/plan9.c
3efed6
@@ -33,6 +33,7 @@
3efed6
 #include <grub/mm.h>
3efed6
 #include <grub/cpu/relocator.h>
3efed6
 #include <grub/extcmd.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -505,6 +506,7 @@ grub_cmd_plan9 (grub_extcmd_context_t ctxt, int argc, char *argv[])
3efed6
   configptr = grub_stpcpy (configptr, "bootfile=");
3efed6
   configptr = grub_stpcpy (configptr, bootpath);
3efed6
   *configptr++ = '\n';
3efed6
+  char *cmdline = configptr;
3efed6
   {
3efed6
     int i;
3efed6
     for (i = 1; i < argc; i++)
3efed6
@@ -513,6 +515,15 @@ grub_cmd_plan9 (grub_extcmd_context_t ctxt, int argc, char *argv[])
3efed6
 	*configptr++ = '\n';
3efed6
       }
3efed6
   }
3efed6
+
3efed6
+  {
3efed6
+    grub_err_t err;
3efed6
+    *configptr = '\0';
3efed6
+    err = grub_verify_string (cmdline, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+    if (err)
3efed6
+      goto fail;
3efed6
+  }
3efed6
+
3efed6
   configptr = grub_stpcpy (configptr, fill_ctx.pmap);
3efed6
 
3efed6
   {
3efed6
diff --git a/grub-core/loader/i386/xen.c b/grub-core/loader/i386/xen.c
b71686
index 82350d3a1..07a4837c5 100644
3efed6
--- a/grub-core/loader/i386/xen.c
3efed6
+++ b/grub-core/loader/i386/xen.c
3efed6
@@ -41,6 +41,7 @@
3efed6
 #include <grub/linux.h>
3efed6
 #include <grub/i386/memory.h>
3efed6
 #include <grub/safemath.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -649,6 +650,9 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)),
3efed6
   grub_create_loader_cmdline (argc - 1, argv + 1,
3efed6
 			      (char *) xen_state.next_start.cmd_line,
3efed6
 			      sizeof (xen_state.next_start.cmd_line) - 1);
3efed6
+  err = grub_verify_string (xen_state.next_start.cmd_line, GRUB_VERIFY_MODULE_CMDLINE);
3efed6
+  if (err)
3efed6
+    return err;
3efed6
 
3efed6
   file = grub_file_open (argv[0], GRUB_FILE_TYPE_LINUX_KERNEL);
3efed6
   if (!file)
3efed6
@@ -916,6 +920,9 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
3efed6
 
3efed6
   grub_create_loader_cmdline (argc - 1, argv + 1,
3efed6
 			      get_virtual_current_address (ch), cmdline_len);
3efed6
+  err = grub_verify_string (get_virtual_current_address (ch), GRUB_VERIFY_MODULE_CMDLINE);
3efed6
+  if (err)
3efed6
+    goto fail;
3efed6
 
3efed6
   xen_state.module_info_page[xen_state.n_modules].cmdline =
3efed6
     xen_state.max_addr - xen_state.modules_target_start;
3efed6
diff --git a/grub-core/loader/ia64/efi/linux.c b/grub-core/loader/ia64/efi/linux.c
b71686
index 750330d45..e325fe0ee 100644
3efed6
--- a/grub-core/loader/ia64/efi/linux.c
3efed6
+++ b/grub-core/loader/ia64/efi/linux.c
3efed6
@@ -33,6 +33,7 @@
3efed6
 #include <grub/i18n.h>
3efed6
 #include <grub/env.h>
3efed6
 #include <grub/linux.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -543,6 +544,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
       p = grub_stpcpy (p, argv[i]);
3efed6
     }
3efed6
   cmdline[10] = '=';
3efed6
+
3efed6
+  *p = '\0';
3efed6
+
3efed6
+  err = grub_verify_string (cmdline, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    goto fail;
3efed6
   
3efed6
   boot_param->command_line = (grub_uint64_t) cmdline;
3efed6
   boot_param->efi_systab = (grub_uint64_t) grub_efi_system_table;
3efed6
diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c
b71686
index 103588544..20135ce25 100644
3efed6
--- a/grub-core/loader/mips/linux.c
3efed6
+++ b/grub-core/loader/mips/linux.c
3efed6
@@ -327,6 +327,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
   linux_argv++;
3efed6
   linux_args += ALIGN_UP (sizeof ("a0"), 4);
3efed6
 
3efed6
+  char *params = linux_args;
3efed6
+
3efed6
 #ifdef GRUB_MACHINE_MIPS_LOONGSON
3efed6
   {
3efed6
     unsigned mtype = grub_arch_machine;
3efed6
@@ -352,6 +354,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
       linux_args += ALIGN_UP (grub_strlen (argv[i]) + 1, 4);
3efed6
     }
3efed6
 
3efed6
+  *linux_args = '\0';
3efed6
+
3efed6
+  err = grub_verify_string (params, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    return err;
3efed6
+
3efed6
   /* Reserve space for rd arguments.  */
3efed6
   rd_addr_arg_off = (grub_uint8_t *) linux_args - (grub_uint8_t *) playground;
3efed6
   linux_args += ALIGN_UP (sizeof ("rd_start=0xXXXXXXXXXXXXXXXX"), 4);
3efed6
diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c
b71686
index 3cfb47650..f64a857e3 100644
3efed6
--- a/grub-core/loader/multiboot_mbi2.c
3efed6
+++ b/grub-core/loader/multiboot_mbi2.c
3efed6
@@ -1077,10 +1077,8 @@ grub_multiboot2_init_mbi (int argc, char *argv[])
3efed6
     return grub_errno;
3efed6
   cmdline_size = len;
3efed6
 
3efed6
-  grub_create_loader_cmdline (argc, argv, cmdline,
3efed6
-			      cmdline_size);
3efed6
-
3efed6
-  return GRUB_ERR_NONE;
3efed6
+  return grub_create_loader_cmdline (argc, argv, cmdline, cmdline_size,
3efed6
+				     GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
 }
3efed6
 
3efed6
 grub_err_t
3efed6
@@ -1109,7 +1107,7 @@ grub_multiboot2_add_module (grub_addr_t start, grub_size_t size,
3efed6
   total_modcmd += ALIGN_UP (len, MULTIBOOT_TAG_ALIGN);
3efed6
 
3efed6
   err = grub_create_loader_cmdline (argc, argv, newmod->cmdline,
3efed6
-				    newmod->cmdline_size);
3efed6
+				    newmod->cmdline_size, GRUB_VERIFY_MODULE_CMDLINE);
3efed6
   if (err)
3efed6
     {
3efed6
       grub_free (newmod->cmdline);
3efed6
diff --git a/grub-core/loader/powerpc/ieee1275/linux.c b/grub-core/loader/powerpc/ieee1275/linux.c
b71686
index 6e814649f..c114e7df4 100644
3efed6
--- a/grub-core/loader/powerpc/ieee1275/linux.c
3efed6
+++ b/grub-core/loader/powerpc/ieee1275/linux.c
3efed6
@@ -302,8 +302,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
 
3efed6
   /* Create kernel command line.  */
3efed6
   grub_memcpy (linux_args, LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv, linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
-			      size);
3efed6
+  if (grub_create_loader_cmdline (argc, argv, linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
+				  size))
3efed6
+    goto out;
3efed6
 
3efed6
 out:
3efed6
 
3efed6
diff --git a/grub-core/loader/sparc64/ieee1275/linux.c b/grub-core/loader/sparc64/ieee1275/linux.c
b71686
index 67ef04883..abe46faa0 100644
3efed6
--- a/grub-core/loader/sparc64/ieee1275/linux.c
3efed6
+++ b/grub-core/loader/sparc64/ieee1275/linux.c
3efed6
@@ -340,8 +340,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
3efed6
 
3efed6
   /* Create kernel command line.  */
3efed6
   grub_memcpy (linux_args, LINUX_IMAGE, sizeof (LINUX_IMAGE));
3efed6
-  grub_create_loader_cmdline (argc, argv, linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
-			      size);
3efed6
+  if (grub_create_loader_cmdline (argc, argv, linux_args + sizeof (LINUX_IMAGE) - 1,
3efed6
+				  size, GRUB_VERIFY_KERNEL_CMDLINE))
3efed6
+    goto out;
3efed6
 
3efed6
 out:
3efed6
   if (elf)
3efed6
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
b71686
index 9f78abb05..5944dc5ea 100644
3efed6
--- a/grub-core/loader/xnu.c
3efed6
+++ b/grub-core/loader/xnu.c
3efed6
@@ -35,6 +35,7 @@
3efed6
 #include <grub/i18n.h>
3efed6
 #include <grub/efi/sb.h>
3efed6
 #include <grub/safemath.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 GRUB_MOD_LICENSE ("GPLv3+");
3efed6
 
3efed6
@@ -429,6 +430,10 @@ grub_cmd_xnu_kernel (grub_command_t cmd __attribute__ ((unused)),
3efed6
   if (ptr != grub_xnu_cmdline)
3efed6
     *(ptr - 1) = 0;
3efed6
 
3efed6
+  err = grub_verify_string (grub_xnu_cmdline, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    return err;
3efed6
+
3efed6
 #if defined (__i386) && !defined (GRUB_MACHINE_EFI)
3efed6
   err = grub_efiemu_autocore ();
3efed6
   if (err)
3efed6
@@ -538,6 +543,10 @@ grub_cmd_xnu_kernel64 (grub_command_t cmd __attribute__ ((unused)),
3efed6
   if (ptr != grub_xnu_cmdline)
3efed6
     *(ptr - 1) = 0;
3efed6
 
3efed6
+  err = grub_verify_string (grub_xnu_cmdline, GRUB_VERIFY_KERNEL_CMDLINE);
3efed6
+  if (err)
3efed6
+    return err;
3efed6
+
3efed6
 #if defined (__i386) && !defined (GRUB_MACHINE_EFI)
3efed6
   err = grub_efiemu_autocore ();
3efed6
   if (err)
3efed6
diff --git a/include/grub/lib/cmdline.h b/include/grub/lib/cmdline.h
b71686
index 1fe8d0179..cdca09b7a 100644
3efed6
--- a/include/grub/lib/cmdline.h
3efed6
+++ b/include/grub/lib/cmdline.h
3efed6
@@ -21,11 +21,12 @@
3efed6
 #define GRUB_CMDLINE_HEADER	1
3efed6
 
3efed6
 #include <grub/types.h>
3efed6
+#include <grub/verify.h>
3efed6
 
3efed6
 #define LINUX_IMAGE "BOOT_IMAGE="
3efed6
 
3efed6
 unsigned int grub_loader_cmdline_size (int argc, char *argv[]);
3efed6
-int grub_create_loader_cmdline (int argc, char *argv[], char *buf,
3efed6
-				grub_size_t size);
3efed6
+grub_err_t grub_create_loader_cmdline (int argc, char *argv[], char *buf,
3efed6
+				       grub_size_t size, enum grub_verify_string_type type);
3efed6
 
3efed6
 #endif /* ! GRUB_CMDLINE_HEADER */
3efed6
diff --git a/include/grub/verify.h b/include/grub/verify.h
b71686
index 298120f57..9f892d8fe 100644
3efed6
--- a/include/grub/verify.h
3efed6
+++ b/include/grub/verify.h
3efed6
@@ -25,6 +25,12 @@ enum grub_verify_flags
3efed6
     GRUB_VERIFY_FLAGS_SINGLE_CHUNK	= 2
3efed6
   };
3efed6
 
3efed6
+enum grub_verify_string_type
3efed6
+  {
3efed6
+    GRUB_VERIFY_KERNEL_CMDLINE,
3efed6
+    GRUB_VERIFY_MODULE_CMDLINE,
3efed6
+  };
3efed6
+
3efed6
 struct grub_file_verifier
3efed6
 {
3efed6
   struct grub_file_verifier *next;
3efed6
@@ -48,6 +54,8 @@ struct grub_file_verifier
3efed6
 
3efed6
   grub_err_t (*fini) (void *context);
3efed6
   void (*close) (void *context);
3efed6
+
3efed6
+  grub_err_t (*verify_string) (char *str, enum grub_verify_string_type type);
3efed6
 };
3efed6
 
3efed6
 extern struct grub_file_verifier *grub_file_verifiers;
3efed6
@@ -63,3 +71,6 @@ grub_verifier_unregister (struct grub_file_verifier *ver)
3efed6
 {
3efed6
   grub_list_remove (GRUB_AS_LIST (ver));
3efed6
 }
3efed6
+
3efed6
+grub_err_t
3efed6
+grub_verify_string (char *str, enum grub_verify_string_type type);