From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933634AbdIYHbn (ORCPT ); Mon, 25 Sep 2017 03:31:43 -0400 Received: from merlin.infradead.org ([205.233.59.134]:38080 "EHLO merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932135AbdIYHbl (ORCPT ); Mon, 25 Sep 2017 03:31:41 -0400 Date: Mon, 25 Sep 2017 09:31:36 +0200 From: Peter Zijlstra To: Meng Xu Cc: Meng Xu , mingo@redhat.com, linux-kernel@vger.kernel.org, sanidhya@gatech.edu, taesoo@gatech.edu Subject: Re: [PATCH] sched/core: Fix a potential double fetch bug on attr->size Message-ID: <20170925073136.vcnxvjjgcxvtusum@hirez.programming.kicks-ass.net> References: <1504033816-50159-1-git-send-email-meng.xu@gatech.edu> <12F594E4-B8AA-436B-933A-4E1DFDDC7E0C@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <12F594E4-B8AA-436B-933A-4E1DFDDC7E0C@gmail.com> User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Sep 23, 2017 at 10:05:56PM -0400, Meng Xu wrote: > Hi Peter and Ingo, > > As a reminder, this is a very similar issue to perf_copy_attr (see following patch) > https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=f12f42acdbb577a12eecfcebbbec41c81505c4dc > > Will it be fixed as well? If someone were to actually send me the patch.. probably. > > On Aug 29, 2017, at 3:10 PM, Meng Xu wrote: > > > > From: Meng Xu > > > > `attr->size` after the second fetch `copy_from_user(attr, uattr, size)`, > > can be different from what is initially fetched in and checked > > `get_user(size, &uattr->size)` by racing condition in the userspace. > > > > The issue and the patch are both similar to commit f12f42a > > (in kernel/events/core.c). > > > > Signed-off-by: Meng Xu > > --- > > kernel/sched/core.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/kernel/sched/core.c b/kernel/sched/core.c > > index 0869b20..c22d2b4 100644 > > --- a/kernel/sched/core.c > > +++ b/kernel/sched/core.c > > @@ -4349,6 +4349,8 @@ static int sched_copy_attr(struct sched_attr __user *uattr, struct sched_attr *a > > if (ret) > > return -EFAULT; > > > > + attr->size = size; > > + > > /* > > * XXX: Do we want to be lenient like existing syscalls; or do we want > > * to be strict and return an error on out-of-bounds values? > > -- > > 2.7.4 > > >