From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935379AbdIYMxp (ORCPT ); Mon, 25 Sep 2017 08:53:45 -0400 Received: from mail-cys01nam02on0122.outbound.protection.outlook.com ([104.47.37.122]:51712 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S934755AbdIYMxn (ORCPT ); Mon, 25 Sep 2017 08:53:43 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=meng.xu@gatech.edu; Subject: Re: [PATCH] sched/core: Fix a potential double fetch bug on attr->size To: Peter Zijlstra , Meng Xu Cc: mingo@redhat.com, linux-kernel@vger.kernel.org, sanidhya@gatech.edu, taesoo@gatech.edu References: <1504033816-50159-1-git-send-email-meng.xu@gatech.edu> <12F594E4-B8AA-436B-933A-4E1DFDDC7E0C@gmail.com> <20170925073136.vcnxvjjgcxvtusum@hirez.programming.kicks-ass.net> From: Meng Xu Message-ID: Date: Mon, 25 Sep 2017 08:53:35 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20170925073136.vcnxvjjgcxvtusum@hirez.programming.kicks-ass.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: [143.215.130.72] X-ClientProxiedBy: SN4PR0201CA0048.namprd02.prod.outlook.com (10.162.76.34) To BN3PR0701MB1736.namprd07.prod.outlook.com (10.163.39.23) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 57310836-0059-400d-2fe6-08d504147220 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:BN3PR0701MB1736; X-Microsoft-Exchange-Diagnostics: 1;BN3PR0701MB1736;3:Ao4AC12sRiGeRV1ljVU0SIgQJAt5qmS+jWhAQitrHlkXoHMfj0L/UDfcAvsT79taI2QFLw9aK7tX1bp7wfNs1EwKgqNRB28I58O/C6KeEya6Y0lJORpFeQM+a6bhdWGtn4G6slWVUE4cRM8useYtzyR2rdYmdKKmRiHIlTKDaik5fxK2sUi3OYLo2nHQHMYcE9QExHyUTYIipEMaqjQIRY7CG8919b8GrwJEtJaJzs6Swur9TmbMfMvJmC88X/K/;25:SwZb1d9MyhfK+ESfhbSolqvGD7aFFjklxFWRyo9gzRLNFGRn60yOVsh9m3D6shN55hCtumQYcIVksthmXTfw1XLXy+eaRRwlME+RgOAvmXx8DSLT3RtbdVpMCHZnVOZsTsyrz3W3CJ7S4XY5RwYBMnV+duF4q25c7NXpXPkf75MVQ5VTqD8Mclph14k06NblFbIHQS57bIP9C3pv7UHwAVN1ptLWwVS4HBzjBILENKVMiQAf0qQeHy/tz+7/BMgyvYvPAm4Z2qyQhZQFMfZts0uC34WY9YHCaQntJYBORrQ0FsUxPVY1cJkDPAaJbUh8QLgmoYngVl0CsSxUXrMNfQ==;31:pF1CR5mXgZk5pLt+SBeENoJu43YB5iQrHtDFoyH9d1nw4O49WwBMOmoVZS6254xpf2YRju4H05njsO3f9rAdOm7DDism02FcpIrixCVYWXo2Q3YvtK+yyB9Hi5lJI71g4FCOUlOP06hWITRqWNTm6aOZJesjGO1oDW+ZfC5vGH/WHNOANOt6DkOT6vvCc9YFv1e87105zCP+URr/GZp3XYSU05JccGj+xg7m1C8usTk= X-MS-TrafficTypeDiagnostic: BN3PR0701MB1736: X-Microsoft-Exchange-Diagnostics: 1;BN3PR0701MB1736;20:J7XENhE1WFMY/3l1Z5kZbxZxlXZpba3ixbh3MCEuCj7z1fPVl6J9QI1XqVN1lFHt63Swqyvdo8TqvcEaB31GJHCJY5TYU86zzkLLAm/9Fzd6DNXL29dVz+FHRUbw3tSku9AozzJfhtyVE8vfbpZZwmHFvCzpwmwhtP4TvyYkx89unY7FRv302OotEIqZiFWQqW1P6J9NK4vgd3yOoa8UCMIlm+k3ue65rR+0dtGDm/6GTM1qR1BrM1FSnynqgne18sLgRi6J0Yg9Rv2bBUtMsIBEVZl+TMV+jY/GbPJWpyfPwtQE6TMQZeBMSXEX8bJZ+h1l8vO/tv/4kBlJvsDtAQ==;4:4NZGMcuWqYsxmVxJNMKwI2hvolMTmWbF7aHKkk/2v4wJ0Jp/R3y4pW8usheAwPkvw81xzNDLb8FvM+hmel4qfAj0Viycybhy8pfgHC5R+VroZKi1oJjyvZHhk62C0H+xO/MZ4/jMM/k9QvkwCcQ9bCqF2T78DDYV1tw6xQL312TjOmCSyOWLuP3j8J1CjMtuQZ7AJ2JKmyIzgXHnCJyux+RSym44rxvkFBzRuxyXm961O8MgG2VJx+mdoCbTeyqm4w2L4i62IO0I9p60OPS0OzszSCZAMbMxC6qmqIwX6Ko= X-Exchange-Antispam-Report-Test: UriScan:(84791874153150); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(10201501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(6041248)(201703131423075)(201702281529075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:BN3PR0701MB1736;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BN3PR0701MB1736; X-Forefront-PRVS: 04410E544A X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(6049001)(376002)(346002)(189002)(24454002)(377454003)(199003)(316002)(65956001)(33646002)(6306002)(64126003)(49976008)(786003)(2906002)(16576012)(189998001)(110136005)(478600001)(50466002)(16526017)(47776003)(58126008)(36756003)(97736004)(966005)(25786009)(3846002)(23676002)(31686004)(90366009)(5660300001)(230700001)(65806001)(53936002)(76176999)(8936002)(81156014)(81166006)(83506001)(65826007)(50986999)(53546010)(54356999)(7736002)(105586002)(68736007)(106356001)(86362001)(66066001)(75432002)(6116002)(305945005)(39060400002)(107886003)(88552002)(8676002)(2950100002)(101416001)(229853002)(6486002)(6246003)(4326008)(31696002)(6666003)(21314002)(3940600001);DIR:OUT;SFP:1102;SCL:1;SRVR:BN3PR0701MB1736;H:[143.215.130.72];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjNQUjA3MDFNQjE3MzY7MjM6dDk1eUZsdmU2a1BkTUN3b1Ywa3NrVWR1?= =?utf-8?B?by9FVjFRcldMYXc3ckFhd0ExbHliRGFNTE5wYUh0YXNveUlDM3I1RjhoMERj?= =?utf-8?B?Ump5d2hQQjdZQlBGNkpxTWtHTXVoMkhLVitTazJQWkttd1RpL2Zad25UK1Jq?= =?utf-8?B?K0NWb1ZMYTlxdElsZ2xodDRvS0UxNG9tYTExd1I1eEE3cjdDcVFiT2N0NTFG?= =?utf-8?B?MndzbThRZXZSM2lmcmZzUXhwSDlWTExrc0dXYVY2Rll6elBWRURCdGRVQUth?= =?utf-8?B?Njk3RHRSVFF5WGxPb0lUdjFmdDVjeHlRbVdQb0hnTC9lbG1ibk40UFJZMGwx?= =?utf-8?B?RFBTdm1pekdyR2k1Wm8wYkpUcUlsWVBsbk1BY3lsWnRxN25WcjZIcElDUzEz?= =?utf-8?B?UHdibzd4R3hqYS9WYlpIb2tkaXNPcnBKb3hLZWZMbXdpTGJnbzQyL210YW5P?= =?utf-8?B?aFVqNUFFaXE1RHg3am5xckx2VFJTUlhKYXg5WmVqTGNZOTVQaC8xelkxTkU2?= =?utf-8?B?a29QZ3p3cndMUWozWkV1UTFLVHpFUmpPc1NrWnJJWWVhUnFuM0xqOW9oNGZM?= =?utf-8?B?TFUvM2lNNGFWU2RLajBEMlJHcXFnOEVVb1NtWmZybFFZQlJVaGFBdDVDMEk2?= =?utf-8?B?Nk1kclljTXdmWjFVMXJjWVVUL1NKejQwMXNkRDA0M3N5eU1ibzFKcnBSOThj?= =?utf-8?B?SGJ6Zm9iVlhjVVc5Z0ZrRWVrRHNoUW1Wclpta0VUajBja25uUWEvbHNiejRl?= =?utf-8?B?OS81dnZGcWhNaU9PbjlXMFN0ZWNlZzZtTWluNFpmU3ZFWXR4ZWcwejhreGJj?= =?utf-8?B?dElnVGs1Yk9wSHZGOE05bGRVWWhtbnpPWlhpZU01UytVVGpTVUp0emhjbUwv?= =?utf-8?B?MFBKR3VTbnZON3JlMk9vdWMyNFhOWVpCQ0hwZE1wbXRyVUV0NGNOc2lxUmQ2?= =?utf-8?B?NTE5MCtnYWhqK2o4c0crYUZ6dEhZS0xqZzg3bm9IK05PL3E4NCtndzhqc1Ju?= =?utf-8?B?VDRUYW55d3BKMmtOWDl1c1RMZlphUHliaFJRMHdIcUkxTWNqK3pCUkhDSmx4?= =?utf-8?B?N3NPQzRHeElRamdHQjFiWVR1ZXR1eU56RE1Kcm1WNEVzc09uYjRlYUxhYXV3?= =?utf-8?B?MmpnYXNUa3VrUlIwbmxDVVdGc2RBb09IWisvTGVRV0MwKy93and6STc2QXM4?= =?utf-8?B?MWlKclVWMXdZa1lHTG1mbDdGTDdwbEt3bWRzV1c3MzlvQ2ROOUFnUTZhOUN6?= =?utf-8?B?bmxHOHMwamUxU2RqVWVGeE9iQi9wRnEyUUUyVTVqckZUN3hxeU5zRzM5MXUz?= =?utf-8?B?M2xOc3k3NXRHdEJTdkg2Rk1wbTFQaFh5Y1ZEbnp5N2FDc21YWm5oQzU4M25G?= =?utf-8?B?U0lEY3MwUE9IZ0w5cElEVUQ0SVhXVmpFVWcrYUlEUGtFd3IrT2JiRWVBOTVF?= =?utf-8?B?c3RjWVk1Y2d4NmZrWnplZG1xcnR2YTlwcVZwOTF6eE9FNzBHM0U0aWphUks2?= =?utf-8?B?cU1iS3JZMkdsNWIyeWxlNXo5OE5JWGtWcmMvMTJrLytNdU5rV0pSZDJKK202?= =?utf-8?B?Rm5IVzAvb05qeVdVeCttUTRyVnRXWjRhS3V1b29wMGROcExoUVhvS1A4TUtv?= =?utf-8?B?bEZIVkJFUVJoK1hqSm52bFNrYjBwL1hTSVQ0M0pWbXBrV0U3K1gwb0diYVpV?= =?utf-8?B?M0FlM25GQlovcGxqM29GMUdyM0d4R1VQYkZrQjZNdGpYT3k5UnRLdkRoVmNs?= =?utf-8?B?cE10QWJ5N3h0Q2dybThhaHQ3VW5ySG9BVDMxTVNVdytIb1VnR1RIdFhUVnRm?= =?utf-8?B?ejk3NldLbVhvclV3dXdZV0VyUytNWnNuODBzTmZvTytMNEoxT1lCWFJ1dDRG?= =?utf-8?B?aDNzZGNCQUUzYjZQNzdJdWplTzliMzMzc3c2QzhrN0ZYdU5uaGpBQkFMUWdn?= =?utf-8?B?NHBPRnZraG1vY0xRRUdUMVhySnpodlBNRmxSTzcrZWg2U2FTYWU3ZEZzMEF0?= =?utf-8?B?ZE5HT0V4SHZtMlJzVW1KaUR2QWQzYkhOR0xFOWoyVXNLd1llQWJoODR6UEZz?= =?utf-8?B?cjB1UkI4UVBOUUp1bGx0a2wwaHZ5RmlHRU5DZzVYd3pRaUVnNGtZaGV6bCsx?= =?utf-8?B?NENSZz09?= X-Microsoft-Exchange-Diagnostics: 1;BN3PR0701MB1736;6:kaCY833cqXFinp0/6Ve7BD2zf+2y8k2ABOaL6j5qZStG9WNWFzeUG/fDxLpF4JFeB28DlfFhT+TgtPhxwezvl22WxNO9eUecwFrgtN35/SxjIC/cdHjJWN9OSwYsqx2ZEZyyYBWZ1Mg9NOfJe0fpAfUIh8tLE/6AMhZ/kQorBBSItZwJUsxNnCHd6FQWMGjMxN/H7JDCcEbhH9XsTEJj+7dTKmixgQqni33miK6J/SCpw5IIq3wn6h8MblBe2BWoAFeiHMriAPR4VqZ7bI97yFFK78BsVeE5MVbaMBG1orgfIF2gjT/lOXo3RgUEpUAWGuA2aIZNB3VVhLHa8J91Gw==;5:Gv6VQSJ1pqaIgRKij4ojf8tjpHomMX9f5CfoFbpECiI/u9GeAcPUKej3FO8bWrnh5x9Yh0uAOZavtQCcg8lwWeFQgLWafIqICDZwevE6I43DE8Prt3a4picibhPuP/kTBKDEZqxQPsnjl9+wvgCWFQ==;24:3Kxt77u8zTNgbm4xDCHLHOM2wGxITuw0FE3wKqee3TC9YNR7IF8TdpTHvoUmBBH22As6ShDW8b5CzsLFFO5APZxlnOdVjZz1KUyz5xZOlIc=;7:E9cf4r6w1vQMtJsfHq2NPiVn6oOMiBiDEoaosCr1XOYn+pX2FGkUWDQ7QK4InmV5V+9QSatarLPupU5hw1jLS6Q4gQuKh4tS3qAklCN6LPpsaKvqCNoOSY5Emfh94453/TYvLhW3pXU7Cx2ZdGXAi6M5vkvDSulyIDU/ZHlZsfWo+rvbwuCTzkJr//fKBlwoftaQOZwds8kIaZ5i/pHyhwjDkOspvDm1TsLPJ9kSOZ0= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: gatech.edu X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Sep 2017 12:53:39.6174 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 482198bb-ae7b-4b25-8b7a-6d7f32faa083 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0701MB1736 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Peter, I am sorry, I thought the patch is included in the forwarded email. I just resent the patch. Please check. Best Regards, Meng On 09/25/2017 03:31 AM, Peter Zijlstra wrote: > On Sat, Sep 23, 2017 at 10:05:56PM -0400, Meng Xu wrote: >> Hi Peter and Ingo, >> >> As a reminder, this is a very similar issue to perf_copy_attr (see following patch) >> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=f12f42acdbb577a12eecfcebbbec41c81505c4dc >> >> Will it be fixed as well? > If someone were to actually send me the patch.. probably. > >>> On Aug 29, 2017, at 3:10 PM, Meng Xu wrote: >>> >>> From: Meng Xu >>> >>> `attr->size` after the second fetch `copy_from_user(attr, uattr, size)`, >>> can be different from what is initially fetched in and checked >>> `get_user(size, &uattr->size)` by racing condition in the userspace. >>> >>> The issue and the patch are both similar to commit f12f42a >>> (in kernel/events/core.c). >>> >>> Signed-off-by: Meng Xu >>> --- >>> kernel/sched/core.c | 2 ++ >>> 1 file changed, 2 insertions(+) >>> >>> diff --git a/kernel/sched/core.c b/kernel/sched/core.c >>> index 0869b20..c22d2b4 100644 >>> --- a/kernel/sched/core.c >>> +++ b/kernel/sched/core.c >>> @@ -4349,6 +4349,8 @@ static int sched_copy_attr(struct sched_attr __user *uattr, struct sched_attr *a >>> if (ret) >>> return -EFAULT; >>> >>> + attr->size = size; >>> + >>> /* >>> * XXX: Do we want to be lenient like existing syscalls; or do we want >>> * to be strict and return an error on out-of-bounds values? >>> -- >>> 2.7.4 >>>