From nobody Sun May 24 18:41:07 2026 Received: from LO0P265CU003.outbound.protection.outlook.com (mail-uksouthazon11022123.outbound.protection.outlook.com [52.101.96.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75ADB233941 for ; Sat, 23 May 2026 21:02:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.96.123 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779570142; cv=fail; b=B3lvBTNkdNRBxXVPGa57SSc8ji2youO1U0fkvQiONjLH/5htsZYkVmzptAEh0zELqgF7jyhS5vlk/8THqJzP16Z616ojSWl4ZO3ghBKxrP5LcCuBTyZdY5FkJX7i6k7aakccWpHHbAvvIIx+VOaNDk0z8OG3Wv07E7ZzkdEf33c= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779570142; c=relaxed/simple; bh=BGOPjBgCgBbIicQjMZhoVmDuzqMUSfYX6DbYofJAsOY=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=Cw6UlAkDFAV34bg1UR71mdDZWnKRy7VUJrgFHzgsIp4J2CRrpE5bUITQxv7dsWVHC9YstYQip5YOb+0eDtN2lpxeNJHJELq/0O2lxUqRvtiYfIwuZW3rnfG/hAr6QHHzTCQBxcF6DvbhzqsIiqjtFmn0UIrZpMqNkP3f1LJG2do= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.96.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=nxeb7R++XDeunar6cYb8R9DRMWkBbW7CJc10HMCMs1okYTQEYZhQ1WjukuRhUCew13dWcfcN1Ku5Wm/T1FzUvAOje088rfW9ZNV/CCDNXyk2EoX7VXWIUMc1GIw9igVxEyAT6mUsIBPhESQ2kihia4J+GA6w73/NgOp89MrKyjG58KodKMfLX1HrE8PzVmQi20xIpJ3+eqV6YBgS7RvbqZ5R8pSI1du0NmY6nmDrILGtGf0ezxRFfoJhwN0f2fkyPAyQCu4q0nwEW33CeK9M89/c90Ta7lkoeCO+GvCOb+enlQQFN9r+FdPtXJLoBDYQbWXrpE0pAXavcr4hTAC+ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=f4+cJeQc4DGwpafx5ytT1FpY9LchN7KRi8/WMA1lMQk=; b=Us7uWNVkeXZ+FPxZqb3Eq7jR3U8NrFzhZw/6zQRjcyH5O2kFl0uXgobj1gxgUrYq1VftMW5z5ziXqmvjcgaWpFnyNkO8Z0JD8rdx+IdDji28DuPxmpn3ms3T91ito72H3byZI8GQP+1DywH0eqwIr+3bSaKRQvq4V+Pruc8rV5BaS0E3ArzikSxxtuj0fl9iAzCr+g2eQe3w0Sukp7NAaoy0H+EWxP57ghWyogA983Tmm3Ic/odnsmASGXPwXMBmCU2kzrZRXwLMZQlGagjHSPhHtwGNHl/3Ca3z3vrSkvJdC7TPZa3YtkpwYb6cAkzVK5xt4HUOtcFC6S5aUqJm/g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB6217.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:1ff::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.18; Sat, 23 May 2026 21:02:18 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0048.016; Sat, 23 May 2026 21:02:17 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, tglx@kernel.org, peterx@redhat.com, linux-kernel@vger.kernel.org Subject: [PATCH] sched/isolation: Prevent out-of-bounds read in isolcpus= boot parameter parser Date: Sat, 23 May 2026 17:02:14 -0400 Message-ID: <20260523210214.593704-1-atomlin@atomlin.com> X-Mailer: git-send-email 2.51.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0697.namprd03.prod.outlook.com (2603:10b6:408:ef::12) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB6217:EE_ X-MS-Office365-Filtering-Correlation-Id: 0621e976-d52e-40a7-155e-08deb90e92c2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|7416014|376014|366016|6133799003|3023799007|56012099003|18002099003; X-Microsoft-Antispam-Message-Info: KM79OmG+eBaBolEW5jvAaCL/2YT0lWDmfNVzsBPnFgpQuG4obt1lK4eJLx5z6zSdmOtYcAcu8E92Ox5FN6VWMZwmOf3677ZlPPUkwxoWf+ptp6fySBXw3i62N6CxDVSjEiiS2UUn+afLBGCTCsf7MkBp90Eyu0a1eb0Rp3DJ7f+C5bchQhOXtpyL1L0+XcIUpPD6bFkdTiuXC/6i+3Ugah0/SabFtvoe7vXcrwbpneCvqqij9yYak6JMiy3syVnd2zMxwJClPlL4P29pslX5ccQ8RpkF0S5Rc+J5mnPVQWZMOdPd44LbJkKKGTvIC3prfZW84WLEvmTG7AB0Kj+rUoqCXNKAY7SI1uk401YeZc/5tDRc0qNFMkVWsR2kKkhSmwHrwVTOT6r+5lnpra0JCN4bnPHpTL/G/iEgQyVM0NFvRq63w6fijg7capuVx0fXgQDhUkXo/rtgIl2KICd2nL8OA9AKnQaaKBPnEZk8D5bC026yAMpkS/ygaUVCQJazccA4BzxAOo1DdSzy9bcjvotKqdYVZ/Bie0qNApS/Py4+RZfchsg9nj7WliF0TdudkwEqZ/ix1wAEMhAgEKUCFZx2SVxlUJwt40DksNdJjMoGL227jddbhe0F/1dRp8Iw2RYaO+pDwp3h+RXToh3B97jcoEuArqmwjBLwyaGuZyc7zf5MzXkt0zoidYlzeyZQ X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(7416014)(376014)(366016)(6133799003)(3023799007)(56012099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Lr26IzkAQb8Xe/JHwpYnAGUWcS12bF7KU9P9+Mo5Fp5Dl3U+NdZs/Ua/a3I0?= =?us-ascii?Q?pmdqxIQaG6cyh6mB7cECyFJ43SbIQBPNlSEgdsMbF+VZ9rC1fvKQ5li8nOok?= =?us-ascii?Q?9lLLfioUoxLfA4jfbh+gMRcE3YeMrBsN4lblQS5T4UlIviDFxMX0NDQVorRo?= =?us-ascii?Q?wP5XUI7hSbYL1MiKweiPPE+PW3lUfJVcHySLyLFmk0v6EzY0kf/+c1c00tCL?= =?us-ascii?Q?an1lx+al/7NWCIbFy40te8Q0UU/IvB9ejpEryRdnDE3ESGFjwIad2E6ozttA?= =?us-ascii?Q?VLAYNzRhevwroxWjhcqxZQ5UGc6fPRW5Dwu3Iq5dXEc3gIbkpL0D24NUg5nJ?= =?us-ascii?Q?QOR/aSvvnez9MeGr3/NjfPydHMnXyn3/GHmc6panp6TglnGxMsjz4mfcWXmC?= =?us-ascii?Q?2g6chUHep/lh5rVDCzeROzLokCn6bC8P/K/x+JM68kwoRfMmESr6qhOIDJWh?= =?us-ascii?Q?Waj6K0uxMepKYoF00wm68bvqm9XK/96o65xjpJAstUJfJwCSbQJDNDM2c3c4?= =?us-ascii?Q?EdUKMKXC1lCQca/qoSxmJRWZL6e560R6A3Jc9G0Pt7AmlL66UKxJRXWNgzPt?= =?us-ascii?Q?rUfUz09HEpCKJmsVOQw9vy6exIuC8JiTYZKyPqezDWRIQfMF3mVHhGb3+Cbo?= =?us-ascii?Q?XtUvkd/Cza/m3qOaD6oxZzKDKC07qVYkvYLwSvnwE4WFOh85j5iBcl1/i7Rj?= =?us-ascii?Q?oiHUKGMdv/OpUKieg62Uh3a3LetDtw79z+J5YIrXrvTb8XmcRTJqB1VFPtSa?= =?us-ascii?Q?N7PTdO4W08Z9+Yc5wj+KMRNXvyfOpfo9xwr0CvijYmmnwQXEkKWkT+WP1845?= =?us-ascii?Q?bgas1zCFdboxeRyWcKq2OSbqRNJylB1Z2h1IUHJ1O7QM5eLpE9FwdY/s7Aij?= =?us-ascii?Q?6lZ5NBqmRNtOwUTI4rniho/ebxPSqamsO0L0hqycMdr4T4AbfKjeEeC1wTS8?= =?us-ascii?Q?ymTJSYWdua8Lg8ZhoA7QuyGk5JRqaIv6/xo55x2C/BON/24n1PuyVyDkcSXx?= =?us-ascii?Q?zdm04leH7h4JT1cRGQirsqWaVMkVV5sNIwrtf83IloapuPd0v0noYb5im15J?= =?us-ascii?Q?l6tn8o6YqGRKJz+PPp44PApvIJ6UqHHigXO/n2wcpfpguC5K0D3szy/kj/QL?= =?us-ascii?Q?7OYdUoGWw6YDkcR9HsMDRs2YisPO3dsLlKn+K0lerF39mu3KHgqxjfy8qe2i?= =?us-ascii?Q?f6TXFvkbLvpBwYwDLVTC+WRGzzw1aDSXdsWJYG7pD/cMmjQtp1pFfc5+Ucf9?= =?us-ascii?Q?VzXcAYpXtt4nTSfIfso0JP0k0ioXu6pmBAtTrIdcxtV5pf9qZ5C9j6bMuXq0?= =?us-ascii?Q?kdb4JLtah58YVSz8Nz/MDAQn47WbU7wjdg9QnODVTJKnmf5BOHg9Zk6SUZGI?= =?us-ascii?Q?oaGnDO4ZNLBAcfp65Kl9Tn2j+yhrKyTrcNXMNd3eNiSvA0tgQMD4fSBM3/OS?= =?us-ascii?Q?CH4S4+wU/MpJKSvec1wdzSitInYLCNSKlp1TjNLSEMWPG6uRwSD+aEvZF6nX?= =?us-ascii?Q?hA5bizG9DE0bUS/JQxinGSzy+42k1hMnzTn7EsF4BGl9DVxs5naenyn+8j9Z?= =?us-ascii?Q?NB8VOefGV3lmsICh05yaCx8d028ig7Jh7ilODiQkl2+XRvEYfOKTCR2ItBSg?= =?us-ascii?Q?WnjMYa6rITuLeWjMK0oq7zeFT+T3a8lR8cfeyVftUEDR0lJqkfTE8LiLMuCS?= =?us-ascii?Q?YHFyl8srqwFQv4QnfFtLROucoR4IWlza/oHzuAmGmQZlBep7smJvLlDc5hhO?= =?us-ascii?Q?NV/goPwf9A=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0621e976-d52e-40a7-155e-08deb90e92c2 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2026 21:02:17.8267 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7ZslISyrqK9+aj4PA8kRVYY7b8C4VAkfmE8UiuuDH0W5sswpOk49FuSAQiSVlzLNNWIlyTHcfhjZK2Gs8FihYA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB6217 Content-Type: text/plain; charset="utf-8" The "isolcpus=3D" boot parameter parser in housekeeping_isolcpus_setup() contains an out-of-bounds memory read bug when handling unterminated flags. When parsing the boot parameter string, the logic expects flags to be comma-separated. If a user passes an unrecognised or legitimate flag at the very end of the string without a trailing comma (e.g., "isolcpus=3Dunknown"), the strict strncmp() checks will fail. The execution then falls through to a fallback for loop designed to skip the unknown sub-parameter. This inner loop consumes characters until it encounters either a comma or the NULL terminator ('\0'). When the loop terminates due to hitting the end of the string, the str pointer rests exactly on the NULL terminator. However, immediately following this inner loop, the code unconditionally executes str++. This advances the pointer past the end of the string and into uninitialised memory. The outer while (isalpha(*str)) loop subsequently evaluates this out-of-bounds memory. If the adjacent byte happens to be alphabetical, the parser will continue reading garbage data, potentially leading to undefined behavior or boot anomalies. Fix this by adding a bounds check immediately before the pointer increment. This ensures the parsing loop cleanly terminates when reaching the end of the boot parameter string. Fixes: 3662daf023500 ("sched/isolation: Allow "isolcpus=3D" to skip unknown= sub-parameters") Signed-off-by: Aaron Tomlin --- kernel/sched/isolation.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c index ef152d401fe2..9813dbeadb6d 100644 --- a/kernel/sched/isolation.c +++ b/kernel/sched/isolation.c @@ -355,6 +355,8 @@ static int __init housekeeping_isolcpus_setup(char *str) } =20 pr_info("isolcpus: Skipped unknown flag %.*s\n", len, par); + if (!*str) + break; str++; } =20 --=20 2.51.0