linux-kernel - [PATCH v2] sched: Fix implicit type conversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1635164377-2426740-1-git-send-email-jiasheng@iscas.ac.cn>
Date:   Mon, 25 Oct 2021 12:19:37 +0000
From:   Jiasheng Jiang <jiasheng@...as.ac.cn>
To:     mingo@...hat.com, peterz@...radead.org, juri.lelli@...hat.com,
        vincent.guittot@...aro.org, dietmar.eggemann@....com,
        rostedt@...dmis.org, bsegall@...gle.com, mgorman@...e.de,
        bristot@...hat.com
Cc:     linux-kernel@...r.kernel.org, Jiasheng Jiang <jiasheng@...as.ac.cn>
Subject: [PATCH v2] sched: Fix implicit type conversion

The variable 'n' is defined as ULONG. However in the cpumask_next(),
it is used as INT.
That is vulnerable and may cause overflow.
For example, if the value of 'n' is (2^31 - 1), then it can pass the
check ('n == 0') and ('n-- > 0'). Then in cpumask_next(), its value
is (2^31 - 3). But it is implicit type conversed to int, its actual
value is -3, which is illegal in the cpumask_next().
Therefore, it might be better to define 'n' as INT.

Fixes: cb152ff ("sched: Fix /proc/sched_stat failure on very very large systems")
Signed-off-by: Jiasheng Jiang <jiasheng@...as.ac.cn>
---
 kernel/sched/stats.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/stats.c b/kernel/sched/stats.c
index 3f93fc3..6503d3a 100644
--- a/kernel/sched/stats.c
+++ b/kernel/sched/stats.c
@@ -82,7 +82,7 @@ static int show_schedstat(struct seq_file *seq, void *v)
  */
 static void *schedstat_start(struct seq_file *file, loff_t *offset)
 {
-	unsigned long n = *offset;
+	int n = *offset;
 
 	if (n == 0)
 		return (void *) 1;
-- 
2.7.4