From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEE553A901F for ; Mon, 9 Mar 2026 14:05:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=216.40.44.13 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773065102; cv=none; b=mIAawL7ZAoaa2vg++fhNDNN1BOcGmVqMCXzsv7PDw/RJuFH9/w51yFUqwaaAv/iyPwFYUhAyxsO8mAD+xTtH8QZ2H106CuFjtjAfjOf/XGAP8srdCyPVKC6gNI2RtVzidlDCCHnx16kihxpDZK9fAeZvGIDeTxuxhXoxbCnoWgE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773065102; c=relaxed/simple; bh=sDd+HY/mTp2vmDuGUPZvKt37PnjVp3cLdwalPkC91SI=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=t3krXEhMGosQBZXcrJ9pyBV1bTz9S3jzfUzNDweCLQ5uwAVbpdm1gfDAk4DMFOpLjqAMd853eyn9/4xKoUTQTnr7V6qbaIDPWvWQiiHVOLXAr3dk0TVu2UtBZ8nwNQ27tHu21xyvguEXNX/73QsshWOOCGdZ7o531HXDb/YGhEc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org; spf=pass smtp.mailfrom=goodmis.org; arc=none smtp.client-ip=216.40.44.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=goodmis.org Received: from omf16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id A95041401DA; Mon, 9 Mar 2026 14:04:58 +0000 (UTC) Received: from [HIDDEN] (Authenticated sender: rostedt@goodmis.org) by omf16.hostedemail.com (Postfix) with ESMTPA id 613402000F; Mon, 9 Mar 2026 14:04:56 +0000 (UTC) Date: Mon, 9 Mar 2026 10:05:03 -0400 From: Steven Rostedt To: Joseph Salisbury Cc: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Ben Segall , Mel Gorman , Valentin Schneider , linux-kernel@vger.kernel.org Subject: Re: [PATCH] sched/isolation: avoid reading past string in isolcpus parser Message-ID: <20260309100503.1966a491@gandalf.local.home> In-Reply-To: <20260306225908.2913977-1-joseph.salisbury@oracle.com> References: <20260306225908.2913977-1-joseph.salisbury@oracle.com> X-Mailer: Claws Mail 3.20.0git84 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 613402000F X-Rspamd-Server: rspamout06 X-Stat-Signature: owmigjmhxhxmzzr3add9z43eh7iuhxw8 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Session-ID: U2FsdGVkX1/dPXuZWq2YjrmTlGhDOzmktDVzBAszjR4= X-HE-Tag: 1773065096-96021 X-HE-Meta: U2FsdGVkX1/nZQZ8v4TTgUmVvO1AZpikcVhbaGm7rXFhZrUi8uXr5Jrcmqs6vQqZIjcnAJVOEOanjqGjbhndnnQJaZLeNmu/wbwA7F53okDuFNEf+2iJmxEWYKjcg3VbBiFLkeu6wQH+WdiTw+SKYZPCNFspmAANfeTUT3zDwew7rVLDHhp1xJViwLqRhnazWibYwRlHLx9RPAYC6Bw2g43XTLdpMNFFgS1iST1mWpryhcFSoo/VRlg+H7Ab1GZmOAdVFgfugPFZE5yzq/i4+uywC34TS9bEGQxmTlhJPNT3Xg2QVisNh7O4k1rEpbArMQascgnBBaIPYFE8uT7lc2MBH8MuWMnROCoVd8MQUHpA4AaY3b+2YA== On Fri, 6 Mar 2026 14:59:08 -0800 Joseph Salisbury wrote: > The function housekeeping_isolcpus_setup() advanced the parser pointer > unconditionally after unknown flags. > > For an argument like 'isolcpus=unknownflag', with no trailing comma, this can > move the pointer past the terminating NUL, and the next loop test reads > out of bounds. > > Advance only when the current character is a comma separator, preserving > existing parsing semantics while avoiding the invalid read. Nice catch. > > Fixes: 3662daf02350 ("sched/isolation: Allow "isolcpus=" to skip unknown sub-parameters") > Cc: stable@vger.kernel.org > Assisted-by: Codex:GPT-5.3 > Signed-off-by: Joseph Salisbury > --- > kernel/sched/isolation.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c > index ef152d401fe2..4cf253fb6d75 100644 > --- a/kernel/sched/isolation.c > +++ b/kernel/sched/isolation.c > @@ -355,7 +355,8 @@ static int __init housekeeping_isolcpus_setup(char *str) > } > > pr_info("isolcpus: Skipped unknown flag %.*s\n", len, par); > - str++; > + if (*str == ',') > + str++; Although it should only be a ',' here, I think it's more robust to just test against non-nul character. As the bug only triggers if str points to the nul character. No need to make this check depend on the rest of the algorithm. if (*str) str++; -- Steve > } > > /* Default behaviour for isolcpus without flags */