Re: [PATCH] lib/cmdline: fix get_options() count and overflow with large ranges

[Andrew Morton]

On Wed, 7 Oct 2026 18:01:08 -0500 LZ <lzsx618@xxxxxxxxx> wrote:

> Hi Andrew,
> 
> I came across this issue independently while using ASan and UBSan to look
> for potential vulnerabilities in the Linux kernel. I do not know Armaan and
> have not been in contact with him, so there was no coordination between our
> submissions. The timing appears to be coincidental.
> 
> Regarding the KUnit changes, both patches add a test function named
> cmdline_test_range_overflow, but the actual test cases are different.
> 
> My fix focuses on preventing the index overflow in get_options(). Armaan's
> patch additionally handles overflow in the range-length subtraction and
> corrects the count when a range exceeds the output array's remaining
> capacity.

OK, thanks.

This is the weirdest thing!

> Based on those differences, Armaan's patch appears to address a broader set
> of related issues. Using his implementation as the basis, while retaining
> any complementary regression tests from my patch, seems reasonable to me.

Great.  Can I add your Reviewed-by to Armaan's patch?

Armaan, can you please check the regression tests, see if there's
anything to be incorporated into yours?