From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751464AbdH2TK7 (ORCPT ); Tue, 29 Aug 2017 15:10:59 -0400 Received: from mx2.gtisc.gatech.edu ([143.215.130.82]:46465 "EHLO mx2.gtisc.gatech.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751231AbdH2TK6 (ORCPT ); Tue, 29 Aug 2017 15:10:58 -0400 From: Meng Xu To: mingo@redhat.com, peterz@infradead.org, linux-kernel@vger.kernel.org Cc: meng.xu@gatech.edu, sanidhya@gatech.edu, taesoo@gatech.edu, Meng Xu Subject: [PATCH] sched/core: Fix a potential double fetch bug on attr->size Date: Tue, 29 Aug 2017 15:10:16 -0400 Message-Id: <1504033816-50159-1-git-send-email-meng.xu@gatech.edu> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Meng Xu `attr->size` after the second fetch `copy_from_user(attr, uattr, size)`, can be different from what is initially fetched in and checked `get_user(size, &uattr->size)` by racing condition in the userspace. The issue and the patch are both similar to commit f12f42a (in kernel/events/core.c). Signed-off-by: Meng Xu --- kernel/sched/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 0869b20..c22d2b4 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -4349,6 +4349,8 @@ static int sched_copy_attr(struct sched_attr __user *uattr, struct sched_attr *a if (ret) return -EFAULT; + attr->size = size; + /* * XXX: Do we want to be lenient like existing syscalls; or do we want * to be strict and return an error on out-of-bounds values? -- 2.7.4