Commit8d4d9c7

Colin Ian King

authored and

Peter Zijlstra

committed

sched/debug: Fix memory corruption caused by multiple small reads of flags

Reading /proc/sys/kernel/sched_domain/cpu*/domain0/flags mutliple timeswith small reads causes oopses with slub corruption issues because the kfree isfree'ing an offset from a previous allocation. Fix this by adding in a newpointer 'buf' for the allocation and kfree and use the temporary pointer tmpto handle memory copies of the buf offsets.Fixes:5b9f8ff ("sched/debug: Output SD flag names rather than their values")Reported-by: Jeff Bastian <jbastian@redhat.com>Signed-off-by: Colin Ian King <colin.king@canonical.com>Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>Link:https://lkml.kernel.org/r/20201029151103.373410-1-colin.king@canonical.com

1 parentb4c9c9f commit8d4d9c7Copy full SHA for 8d4d9c7

File tree

1 file changed

-6

lines changed

kernel/sched
- debug.c

1 file changed

-6

lines changed

`‎kernel/sched/debug.c‎`

Lines changed: 6 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -251,7 +251,7 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,`
`251`	`251`	`unsigned longflags=(unsigned long)table->data;`
`252`	`252`	`size_tdata_size=0;`
`253`	`253`	`size_tlen=0;`
`254`		`-char*tmp;`
	`254`	`+chartmp,buf;`
`255`	`255`	`intidx;`
`256`	`256`
`257`	`257`	`if (write)`
`@@ -269,17 +269,17 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,`
`269`	`269`	`return0;`
`270`	`270`	`}`
`271`	`271`
`272`		`-tmp=kcalloc(data_size+1,sizeof(*tmp),GFP_KERNEL);`
`273`		`-if (!tmp)`
	`272`	`+buf=kcalloc(data_size+1,sizeof(*buf),GFP_KERNEL);`
	`273`	`+if (!buf)`
`274`	`274`	`return-ENOMEM;`
`275`	`275`
`276`	`276`	`for_each_set_bit(idx,&flags,__SD_FLAG_CNT) {`
`277`	`277`	`char*name=sd_flag_debug[idx].name;`
`278`	`278`
`279`		`-len+=snprintf(tmp+len,strlen(name)+2,"%s ",name);`
	`279`	`+len+=snprintf(buf+len,strlen(name)+2,"%s ",name);`
`280`	`280`	`}`
`281`	`281`
`282`		`-tmp+=*ppos;`
	`282`	`+tmp=buf+*ppos;`
`283`	`283`	`len-=*ppos;`
`284`	`284`
`285`	`285`	`if (len>*lenp)`
`@@ -294,7 +294,7 @@ static int sd_ctl_doflags(struct ctl_table *table, int write,`
`294`	`294`	`*lenp=len;`
`295`	`295`	`*ppos+=len;`
`296`	`296`
`297`		`-kfree(tmp);`
	`297`	`+kfree(buf);`
`298`	`298`
`299`	`299`	`return0;`
`300`	`300`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit8d4d9c7

File tree

1 file changed

1 file changed

`‎kernel/sched/debug.c‎`

0 commit comments