Re: compat_sys_sched_setaffinity()

[Andrew Morton <akpm@osdl.org>]

Andrew Morton <akpm@osdl.org> wrote:
>
> 
> This is broken for NR_CPUS > 64, is it not?
> 
> asmlinkage long compat_sys_sched_setaffinity(compat_pid_t pid, 
> 					     unsigned int len,
> 					     compat_ulong_t *user_mask_ptr)
> {
> 	unsigned long kernel_mask;
> 	mm_segment_t old_fs;
> 	int ret;
> 
> 	if (get_user(kernel_mask, user_mask_ptr))
> 		return -EFAULT;
> 
> 	old_fs = get_fs();
> 	set_fs(KERNEL_DS);
> 	ret = sys_sched_setaffinity(pid,
> 				    sizeof(kernel_mask),
> 				    &kernel_mask);
> 	set_fs(old_fs);
> 
> 	return ret;
> }
> 

It also seems to be broken with NR_CPUS > 32.  The syscall API says
(implies?) that CPU 0 is the LSB of *user_mask_ptr.  On a big-endian 32-bit
app, an attempt to bind to CPU #0 will end up binding to CPU #33, methinks.


And it's potentially trying to copy more than `len' bytes from userspace so
it might incorrectly return -EFAULT.


And it's failing to check that len >= sizeof(cpumask_t).  If the user
passes in len==1, he gets bound to garbage CPUs.


Needs work.