diff options
| author | Armaan Sandhu <armaan.sandhu0504@gmail.com> | 2026-10-05 17:39:45 -0400 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-10-08 23:06:54 -0700 |
| commit | 9a610ab75cd33ff6ff21593dc1cdc9858d72d684 (patch) | |
| tree | 97f76ad8ec7cd83b2f729bcb139ccad2b403a6c6 /tools/lib/python/kdoc | |
| parent | 8822f38fc701da92f42677eb3d4cc4b254e4ecc0 (diff) | |
| download | linux-next-9a610ab75cd33ff6ff21593dc1cdc9858d72d684.tar.gz linux-next-9a610ab75cd33ff6ff21593dc1cdc9858d72d684.zip | |
lib/cmdline: fix get_options() count and overflow with large ranges
get_range() stops writing once the array is full, but get_options() still
advances its index by the whole range. So "1-100" parsed into four ints
reports 99 numbers, and a range like "0-2147483647" wraps the index
negative and writes outside the array.
Stop once a range fills the array, bail out in validation mode before the
count overflows, and saturate the range length in get_range(). Add KUnit
cases; without the fix "0-2147483647" panics the test kernel.
Only root can supply this input, so this is a robustness fix.
Link: https://lore.kernel.org/20261005213945.359905-1-armaan.sandhu0504@gmail.com
Fixes: 22f2e2801799 ("[PATCH] get_options to allow a hypenated range for isolcpus")
Signed-off-by: Armaan Sandhu <armaan.sandhu0504@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Leizhen Zhang <lzsx618@gmail.com>
Reviewed-by: Leizhen Zhang <lzsx618@gmail.com>
Cc: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <stable@vger.kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions