From nobody Thu Apr 9 09:03:22 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C11C436EAA2 for ; Mon, 9 Mar 2026 22:02:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773093738; cv=none; b=kXaAoIfNpefFin46gpgpFmsocDD3R5NeUUa/LKSeaIaWrLy79JWBsrRShK61FRkFZFc10bwMyY3aXx+mM2RIu7CVVIFeKla7Q3VAku7lCCIVwIIRPjVdawk9O0I7dn/yjyh2iEAYaJhBIbVGn+zZscN/7pG9NRSl/dtAMt+uY7Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773093738; c=relaxed/simple; bh=hop9rVGv026Wpt7lmApW8ksSe7blGEn0t95PoghsZPg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sW22Kj3A+Mtpkcy63Ntec3cWzPHHcsJFT8lo0EqQclpUwg8O6tB8RCX1lZKmjuqK/wFO22fJnIZHui2FedJkAjoobJT/gIDamFopUOyOSQmFp0nty+nwOUnlMnrnFY9FSmnPndZ3weGi4O4PaQIO5FBBPP2/+M5s1agR3YP4BXo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61231C2BCB0; Mon, 9 Mar 2026 22:02:18 +0000 (UTC) From: Joseph Salisbury To: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot Cc: Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , linux-kernel@vger.kernel.org Subject: [PATCH v2] sched/isolation: avoid reading past string in isolcpus parser Date: Mon, 9 Mar 2026 18:02:16 -0400 Message-ID: <20260309220216.198478-1-joseph.salisbury@oracle.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The function housekeeping_isolcpus_setup() advanced the parser pointer unconditionally after unknown flags. For an argument like 'isolcpus=3Dunknownflag', with no trailing comma, this can move the pointer past the terminating NUL, and the next loop test reads out of bounds. Reproducer: isolcpus=3Dunknownflag Advance only when the parser is not already at the terminating NUL, preserving existing parsing semantics while avoiding the invalid read. Fixes: 3662daf02350 ("sched/isolation: Allow "isolcpus=3D" to skip unknown = sub-parameters") Cc: stable@vger.kernel.org Cc: Steven Rostedt Assisted-by: Codex:GPT-5 Signed-off-by: Joseph Salisbury Reviewed-by: Steven Rostedt (Google) --- v2: - Advance past any non-NUL separator instead of checking specifically for ','. kernel/sched/isolation.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c index ef152d401fe2..402a1e335277 100644 --- a/kernel/sched/isolation.c +++ b/kernel/sched/isolation.c @@ -355,7 +355,8 @@ static int __init housekeeping_isolcpus_setup(char *str) } =20 pr_info("isolcpus: Skipped unknown flag %.*s\n", len, par); - str++; + if (*str) + str++; } =20 /* Default behaviour for isolcpus without flags */ --=20 2.47.3