sched/debug: Fix memory corruption caused by multiple small reads of flags (8d4d9c7b) · Commits · 戴 / test

Reading /proc/sys/kernel/sched_domain/cpu*/domain0/flags mutliple times with small reads causes oopses with slub corruption issues because the kfree is free'ing an offset from a previous allocation. Fix this by adding in a new pointer 'buf' for the allocation and kfree and use the temporary pointer tmp to handle memory copies of the buf offsets. Fixes: ("sched/debug: Output SD flag names rather than their values") Reported-by:

Jeff Bastian <jbastian@redhat.com> Signed-off-by:

Colin Ian King <colin.king@canonical.com> Signed-off-by:

Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by:

Valentin Schneider <valentin.schneider@arm.com> Link: https://lkml.kernel.org/r/20201029151103.373410-1-colin.king@canonical.com

kernel/sched/debug.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -251,7 +251,7 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,
		unsigned long flags = (unsigned long )table->data;
		size_t data_size = 0;
		size_t len = 0;
		char *tmp;
		char tmp, buf;
		int idx;

		if (write)
		@@ -269,17 +269,17 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,
		return 0;
		}

		tmp = kcalloc(data_size + 1, sizeof(*tmp), GFP_KERNEL);
		if (!tmp)
		buf = kcalloc(data_size + 1, sizeof(*buf), GFP_KERNEL);
		if (!buf)
		return -ENOMEM;

		for_each_set_bit(idx, &flags, __SD_FLAG_CNT) {
		char *name = sd_flag_debug[idx].name;

		len += snprintf(tmp + len, strlen(name) + 2, "%s ", name);
		len += snprintf(buf + len, strlen(name) + 2, "%s ", name);
		}

		tmp += *ppos;
		tmp = buf + *ppos;
		len -= *ppos;

		if (len > *lenp)
		@@ -294,7 +294,7 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,
		*lenp = len;
		*ppos += len;

		kfree(tmp);
		kfree(buf);

		return 0;
		}

Admin message