linux-kernel - [PATCH 2/3] cpuset: zero malloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070609013443.17278.12422.sendpatchset@jackhammer.engr.sgi.com>
Date:	Fri, 08 Jun 2007 18:34:43 -0700
From:	Paul Jackson <pj@....com>
To:	Andrew Morton <akpm@...l.org>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"Serge E. Hallyn" <serue@...ibm.com>,
	Dave Hansen <haveblue@...ibm.com>,
	Paul Menage <menage@...gle.com>, linux-kernel@...r.kernel.org,
	Kirill Korotaev <dev@...nvz.org>,
	Herbert Poetzl <herbert@...hfloor.at>,
	Srivatsa Vaddagiri <vatsa@...ibm.com>,
	Paul Jackson <pj@....com>, Balbir Singh <balbir@...ibm.com>
Subject: [PATCH 2/3] cpuset: zero malloc - revert the old cpuset fix

From: Paul Jackson <pj@....com>

Second of three -- This one undoes the first one.  Apply before
the container patch that changes cpusets to use containers,
in order to avoid a patch conflict.

The cpuset code to present a list of tasks using a cpuset to
user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.

The problem was that the code didn't check for writes past
the allocated end of the array until -after- the first write.

This is a race condition that is likely rare -- it would only
show up if a cpuset went from being empty to having a task
in it, during the brief time between the allocation and the
first write.

Prior to roughly 2.6.22 kernels, this was also a benign
problem, because a zero kmalloc returned a few usable bytes
anyway, and no harm was done with the bogus write.

With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero
size allocation, this problem is no longer benign.  This
cpuset code would occassionally trigger that warning.

The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.

Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: "Serge E. Hallyn" <serue@...ibm.com>
Cc: Balbir Singh <balbir@...ibm.com>
Cc: Dave Hansen <haveblue@...ibm.com>
Cc: Herbert Poetzl <herbert@...hfloor.at>
Cc: Kirill Korotaev <dev@...nvz.org>
Cc: Paul Menage <menage@...gle.com>
Cc: Srivatsa Vaddagiri <vatsa@...ibm.com>
Cc: Christoph Lameter <clameter@....com>

Signed-off-by: Paul Jackson <pj@....com>

---

Andrew,

This is the second of three in the set - it reverses the
first one, to avoid colliding with the container patches.

Apply somewhere before, or entirely merge into:
    containersv10-share-css_group-arrays-between-tasks-with-same-container-memberships.patch

 kernel/cpuset.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- 2.6.22-rc4-mm2.orig/kernel/cpuset.c	2007-06-08 14:57:59.091074320 -0700
+++ 2.6.22-rc4-mm2/kernel/cpuset.c	2007-06-08 15:34:24.336172342 -0700
@@ -1620,9 +1620,9 @@ static int pid_array_load(pid_t *pidarra

 	do_each_thread(g, p) {
 		if (p->cpuset == cs) {
+			pidarray[n++] = p->pid;
 			if (unlikely(n == npids))
 				goto array_full;
-			pidarray[n++] = p->pid;
 		}
 	} while_each_thread(g, p);

-- 
                          I won't rest till it's the best ...
                          Programmer, Linux Scalability
                          Paul Jackson <pj@....com> 1.650.933.1373
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/