From: Joe Korty <joe.korty@concurrent-rt.com>
To: Waiman Long <longman@redhat.com>
Cc: linux-kernel@vger.kernel.org,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@kernel.org>
Subject: [BUG 6.4] sched/core: Possible buffer overflow in do_set_cpu_allowed
Date: Fri, 7 Jul 2023 16:28:51 -0400 [thread overview]
Message-ID: <20230707202851.GA4231@zipoli.concurrent-rt.com> (raw)
In commit 9a5418bc48bab ("sched/core: Use kfree_rcu() in
do_set_cpus_allowed()"), a kfree_rcu() is used to free a cpu mask.
However, cpu masks can be as short as 8 bytes and this is a problem,
as kfree_rcu requires the to-be freed buffer to be at least 16 bytes.
Thus there is a chance of buffer overflow corruption when the number of
possible cpus in the system is 64 or less.
I have not seen this corruption in the wild. I only noticed this possibility
when reviewing the scheduler differences between 6.1 and 6.4.
Regards,
Joe Korty
next reply other threads:[~2023-07-07 20:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-07 20:28 Joe Korty [this message]
2023-07-07 23:24 ` [BUG 6.4] sched/core: Possible buffer overflow in do_set_cpu_allowed Waiman Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230707202851.GA4231@zipoli.concurrent-rt.com \
--to=joe.korty@concurrent-rt.com \
--cc=linux-kernel@vger.kernel.org \
--cc=longman@redhat.com \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox