tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()

JIRA: https://issues.redhat.com/browse/RHEL-117873

CVE: CVE-2025-39887

commit c1628c0
Author: Wang Liang <wangliang74@huawei.com>
Date:   Sat Sep 6 11:56:10 2025 +0800

    tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()

    A crash was observed with the following output:

    BUG: kernel NULL pointer dereference, address: 0000000000000010
    Oops: Oops: 0000 [#1] SMP NOPTI
    CPU: 2 UID: 0 PID: 92 Comm: osnoise_cpus Not tainted 6.17.0-rc4-00201-gd69eb204c255 #138 PREEMPT(voluntary)
    RIP: 0010:bitmap_parselist+0x53/0x3e0
    Call Trace:
     <TASK>
     osnoise_cpus_write+0x7a/0x190
     vfs_write+0xf8/0x410
     ? do_sys_openat2+0x88/0xd0
     ksys_write+0x60/0xd0
     do_syscall_64+0xa4/0x260
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
     </TASK>

    This issue can be reproduced by below code:

    fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY);
    write(fd, "0-2", 0);

    When user pass 'count=0' to osnoise_cpus_write(), kmalloc() will return
    ZERO_SIZE_PTR (16) and cpulist_parse() treat it as a normal value, which
    trigger the null pointer dereference. Add check for the parameter 'count'.

    Cc: <mhiramat@kernel.org>
    Cc: <mathieu.desnoyers@efficios.com>
    Cc: <tglozar@redhat.com>
    Link: https://lore.kernel.org/20250906035610.3880282-1-wangliang74@huawei.com
    Fixes: 17f8910 ("tracing/osnoise: Allow arbitrarily long CPU string")
    Signed-off-by: Wang Liang <wangliang74@huawei.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Signed-off-by: Tomas Glozar <tglozar@redhat.com>

Author: lenticularis39

kernel/trace/trace_osnoise.c

@@ -2328,6 +2328,9 @@ osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count,
 	int running, err;
 	char *buf __free(kfree) = NULL;
 
+	if (count < 1)
+		return 0;
+
 	buf = kmalloc(count, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;