Blame SOURCES/0001-irqbalance-ui-skip-in-parse_setup-to-avoid-coredump.patch

8dca8a
From c8d1fff0f16ad906cca153a22faac11516ccc0dd Mon Sep 17 00:00:00 2001
8dca8a
From: Liu Chao <liuchao173@huawei.com>
8dca8a
Date: Mon, 18 Jul 2022 16:54:53 +0800
8dca8a
Subject: [PATCH] irqbalance-ui: skip ',' in parse_setup to avoid coredump
8dca8a
8dca8a
When processing the ',' in hex_to_bitmap, it returns '0000\ 0' directly.
8dca8a
The return value will be freed in parse_setup, but it is not requested
8dca8a
through malloc.
8dca8a
8dca8a
Fixes: 85d37098a551 ("Fix several memleak problems found by covscan")
8dca8a
8dca8a
And it treat ',' as "0000", which cause irqbalance-ui will display wrong
8dca8a
Banned CPU numbers.
8dca8a
8dca8a
For example:
8dca8a
# IRQBALANCE_BANNED_CPUS="00000002,00000000,00000000" ./irqbalance
8dca8a
or
8dca8a
# IRQBALANCE_BANNED_CPULIST="65" ./irqbalance
8dca8a
8dca8a
# ./irqbalance-ui
8dca8a
Banned CPU numbers: 73
8dca8a
8dca8a
Fixes: 76d1c9d73935 ("Add main user interface files")
8dca8a
8dca8a
Signed-off-by: Liu Chao <liuchao173@huawei.com>
8dca8a
---
8dca8a
 ui/irqbalance-ui.c | 7 +++++--
8dca8a
 1 file changed, 5 insertions(+), 2 deletions(-)
8dca8a
8dca8a
diff --git a/ui/irqbalance-ui.c b/ui/irqbalance-ui.c
8dca8a
index 47b6c88..b7f9b62 100644
8dca8a
--- a/ui/irqbalance-ui.c
8dca8a
+++ b/ui/irqbalance-ui.c
8dca8a
@@ -142,7 +142,7 @@ try_again:
8dca8a
 void parse_setup(char *setup_data)
8dca8a
 {
8dca8a
 	char *token, *ptr;
8dca8a
-	int i,j;
8dca8a
+	int i,j, cpu = 0;
8dca8a
 	char *copy;
8dca8a
 	irq_t *new_irq = NULL;
8dca8a
 	if((setup_data == NULL) || (strlen(setup_data) == 0)) return;
8dca8a
@@ -179,14 +179,17 @@ void parse_setup(char *setup_data)
8dca8a
 	if(strncmp(token, "BANNED", strlen("BANNED"))) goto out;
8dca8a
 	token = strtok_r(NULL, " ", &ptr);
8dca8a
 	for(i = strlen(token) - 1; i >= 0; i--) {
8dca8a
+		if (token[i] == ',')
8dca8a
+			continue;
8dca8a
 		char *map = hex_to_bitmap(token[i]);
8dca8a
 		for(j = 3; j >= 0; j--) {
8dca8a
 			if(map[j] == '1') {
8dca8a
 				uint64_t *banned_cpu = malloc(sizeof(uint64_t));
8dca8a
-				*banned_cpu = (4 * (strlen(token) - (i + 1)) + (4 - (j + 1)));
8dca8a
+				*banned_cpu = cpu;
8dca8a
 				setup.banned_cpus = g_list_append(setup.banned_cpus,
8dca8a
 								banned_cpu);
8dca8a
 			}
8dca8a
+			cpu++;
8dca8a
 		}
8dca8a
 		free(map);
8dca8a
 	
8dca8a
-- 
8dca8a
2.33.1
8dca8a