From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDD011C2AA; Thu, 8 Oct 2026 00:08:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791418133; cv=none; b=dycUKzA2lv0qtSwUGyKQ/qo/3CpHwRZQLWh17wiwLfwdWAfLR6fn/jq8gTLYP1VKuJZeG0XjTUEiAvCQ6aqWHr2txp9+l7ES9jYN6ES3TPSKDEnLUt1UQOCoW7/X8VonCDEXf4WmxhkNldg8Lk/29y2hV0ncpYLrNWmWGVKs7Dk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791418133; c=relaxed/simple; bh=R/dS0lqWq2OrEXP3DgphPGV79bFNL+NkWvrBs32GjxY=; h=Date:To:From:Subject:Message-Id; b=U8ePhRn4nEkr7F9uYGrHUESbPXKRlpgkdDYHkDGmSlmxiFrL6EcIiY38skLqoPYlKBnpsE6A4avIEHKa3oarJA0qsmiriuGpa0G4DdhEaAcUUMw2+ZVm8nNCUQlPqznHFIO+axpX8huNKqSFZ+uZWGnosqaILVewH7CRVrPvSVA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=ISurjKsE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="ISurjKsE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E8EB1F000FF; Thu, 8 Oct 2026 00:08:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1791418131; bh=KHVBkq8qA+muUIAzurKvzO3XxmkGWmC3OVgRJCv8rVc=; h=Date:To:From:Subject; b=ISurjKsE/q48k4ezxZsh/P+v0wZjku0y1Ioxp7oCQlQSUlfmN3eqB5WuEsO8KQwkY XwC+EtzLhwsYy81yTVDfePBOiLbxrU6hMwiMgcGakzhwMCdP5RQe3KBH0Heuh6L1FU yTVdos8SmZd+gWEyUlHB9zCqNcZHm571ovEjrrfg= Date: Wed, 07 Oct 2026 17:08:51 -0700 To: mm-commits@vger.kernel.org,stable@vger.kernel.org,lzsx618@gmail.com,andriy.shevchenko@intel.com,armaan.sandhu0504@gmail.com,akpm@linux-foundation.org From: Andrew Morton Subject: + lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges.patch added to mm-nonmm-unstable branch Message-Id: <20261008000851.7E8EB1F000FF@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: lib/cmdline: fix get_options() count and overflow with large ranges has been added to the -mm mm-nonmm-unstable branch. Its filename is lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges.patch This patch will later appear in the mm-nonmm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Armaan Sandhu Subject: lib/cmdline: fix get_options() count and overflow with large ranges Date: Mon, 5 Oct 2026 17:39:45 -0400 get_range() stops writing once the array is full, but get_options() still advances its index by the whole range. So "1-100" parsed into four ints reports 99 numbers, and a range like "0-2147483647" wraps the index negative and writes outside the array. Stop once a range fills the array, bail out in validation mode before the count overflows, and saturate the range length in get_range(). Add KUnit cases; without the fix "0-2147483647" panics the test kernel. Only root can supply this input, so this is a robustness fix. Link: https://lore.kernel.org/20261005213945.359905-1-armaan.sandhu0504@gmail.com Fixes: 22f2e2801799 ("[PATCH] get_options to allow a hypenated range for isolcpus") Signed-off-by: Armaan Sandhu Signed-off-by: Andrew Morton Reported-by: Leizhen Zhang Reviewed-by: Leizhen Zhang Cc: Andy Shevchenko Cc: --- lib/cmdline.c | 13 +++++++++++- lib/tests/cmdline_kunit.c | 38 ++++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) --- a/lib/cmdline.c~lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges +++ a/lib/cmdline.c @@ -11,6 +11,7 @@ #include #include +#include #include #include @@ -26,7 +27,9 @@ static int get_range(char **str, int *pi (*str)++; upper_range = simple_strtol((*str), NULL, 0); - inc_counter = upper_range - *pint; + /* Keep the sign of the result when the difference doesn't fit */ + if (check_sub_overflow(upper_range, *pint, &inc_counter)) + inc_counter = upper_range < *pint ? -1 : INT_MAX; for (x = *pint; n && x < upper_range; x++, n--) *pint++ = x; return inc_counter; @@ -122,6 +125,14 @@ char *get_options(const char *str, int n range_nums = get_range((char **)&str, pint, n); if (range_nums < 0) break; + /* The range didn't fit, so the array is full */ + if (!validate && range_nums > n) { + i = nints; + break; + } + /* Leave room for the upper number of the range */ + if (range_nums >= INT_MAX - i) + break; /* * Decrement the result by one to leave out the * last number in the range. The next iteration --- a/lib/tests/cmdline_kunit.c~lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges +++ a/lib/tests/cmdline_kunit.c @@ -140,6 +140,43 @@ static void cmdline_test_range(struct ku } while (++i < ARRAY_SIZE(cmdline_test_range_strings)); } +static const struct { + const char *in; + int parsed[4]; + int validated; +} cmdline_test_range_overflow_cases[] = { + { "1-100", { 3, 1, 2, 3, }, 100, }, + { "1,5-100,7", { 3, 1, 5, 6, }, 98, }, + { "1-2147483646", { 3, 1, 2, 3, }, 2147483646, }, + { "0-2147483647", { 3, 0, 1, 2, }, 0, }, + { "-5-2147483647", { 3, -5, -4, -3, }, 0, }, + { "2147483647--5", { 0, 2147483647, }, 0, }, +}; + +static void cmdline_test_range_overflow(struct kunit *test) +{ + unsigned int i, j; + + for (i = 0; i < ARRAY_SIZE(cmdline_test_range_overflow_cases); i++) { + const char *in = cmdline_test_range_overflow_cases[i].in; + const int *e = cmdline_test_range_overflow_cases[i].parsed; + /* Two guard elements past the array handed to get_options() */ + int r[ARRAY_SIZE(cmdline_test_range_overflow_cases[0].parsed) + 2]; + int n; + + memset(r, 0, sizeof(r)); + get_options(in, ARRAY_SIZE(r) - 2, r); + for (j = 0; j < ARRAY_SIZE(r) - 2; j++) + KUNIT_EXPECT_EQ_MSG(test, r[j], e[j], "Pattern: %s at %u", in, j); + for (; j < ARRAY_SIZE(r); j++) + KUNIT_EXPECT_EQ_MSG(test, r[j], 0, "Pattern: %s out of bound at %u", in, j); + + get_options(in, 0, &n); + KUNIT_EXPECT_EQ_MSG(test, n, cmdline_test_range_overflow_cases[i].validated, + "Pattern: %s (validated)", in); + } +} + static void cmdline_test_next_arg_quoted_value(struct kunit *test) { char in[] = "foo=\"bar baz\" qux=1"; @@ -258,6 +295,7 @@ static struct kunit_case cmdline_test_ca KUNIT_CASE(cmdline_test_lead_int), KUNIT_CASE(cmdline_test_tail_int), KUNIT_CASE(cmdline_test_range), + KUNIT_CASE(cmdline_test_range_overflow), KUNIT_CASE(cmdline_test_next_arg_quoted_value), KUNIT_CASE(cmdline_test_next_arg_bare_quote_regression), KUNIT_CASE(cmdline_test_next_arg_mixed_tokens), _ Patches currently in -mm which might be from armaan.sandhu0504@gmail.com are lib-cmdline-fix-get_options-count-and-overflow-with-large-ranges.patch