[PATCH v2 3/3] mips: sched: Fix CPUMASK_OFFSTACK memory corruption
flat view
STALE169d
From: Aaron Tomlin <atomlin@atomlin.com>
Date: 2026-05-09 21:38:27
Also in:
cgroups, linux-fsdevel, linux-mips, lkml, selinux
Subsystem:
mips, the rest · Maintainers:
Thomas Bogendoerfer, Linus Torvalds
Revision v2 (2 revisions archived).
Revisions (2)
- v1
- v2 current [diff against previous]
This patch addresses a critical memory management flaw.
When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer.
Consequently, sizeof(new_mask) evaluates to the pointer size, causing
copy_from_user() to clobber the stack pointer. The subsequent
alloc_cpumask_var() overwrites this with an uninitialised heap address,
discarding the user's mask and risking data leaks. Fix this by
allocating masks first, and using cpumask_size() to copy data directly
into the allocated buffer.
Fixes: 295cbf6d63165 ("[MIPS] Move FPU affinity code into separate file.")
Cc: <redacted>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
arch/mips/kernel/mips-mt-fpaff.c | 32 +++++++++++++++-----------------
1 file changed, 15 insertions(+), 17 deletions(-)
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index 6424152d9091..7c215372c5e8 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c@@ -71,17 +71,23 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, struct task_struct *p; int retval; + if (len < cpumask_size()) + return -EINVAL; + if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) return -ENOMEM; - - if (len < sizeof(new_mask)) { - retval = -EINVAL; + if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) { + retval = -ENOMEM; goto out_free_new_mask; } + if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) { + retval = -ENOMEM; + goto out_free_cpus_allowed; + } - if (copy_from_user(&new_mask, user_mask_ptr, sizeof(new_mask))) { + if (copy_from_user(new_mask, user_mask_ptr, cpumask_size())) { retval = -EFAULT; - goto out_free_new_mask; + goto out_free_effective_mask; } cpus_read_lock();
@@ -92,21 +98,13 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, rcu_read_unlock(); cpus_read_unlock(); retval = -ESRCH; - goto out_free_new_mask; + goto out_free_effective_mask; } /* Prevent p going away */ get_task_struct(p); rcu_read_unlock(); - if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) { - retval = -ENOMEM; - goto out_put_task; - } - if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) { - retval = -ENOMEM; - goto out_free_cpus_allowed; - } if (!check_same_owner(p) && !capable(CAP_SYS_NICE)) { retval = -EPERM; goto out_unlock;
@@ -145,12 +143,12 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, } } out_unlock: + put_task_struct(p); + cpus_read_unlock(); +out_free_effective_mask: free_cpumask_var(effective_mask); out_free_cpus_allowed: free_cpumask_var(cpus_allowed); -out_put_task: - put_task_struct(p); - cpus_read_unlock(); out_free_new_mask: free_cpumask_var(new_mask); return retval;
--
2.51.0