Messages in this thread Patch in this message | | | From | Waiman Long <> | Subject | [PATCH v7 5/5] sched: Fix sched_setaffinity() and fork/clone() race | Date | Fri, 2 Sep 2022 11:25:56 -0400 |
| |
sched_setaffinity() can also race with a concurrent fork/clone() syscall calling dup_user_cpus_ptr(). That may lead to a use after free problem. Fix that by protecting the cpumask copying using pi_lock of the source task.
Signed-off-by: Waiman Long <longman@redhat.com> --- kernel/sched/core.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 618341d0fa51..7157c9a3f31e 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2602,6 +2602,8 @@ void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask) int dup_user_cpus_ptr(struct task_struct *dst, struct task_struct *src, int node) { + unsigned long flags; + if (!src->user_cpus_ptr) return 0; @@ -2609,7 +2611,10 @@ int dup_user_cpus_ptr(struct task_struct *dst, struct task_struct *src, if (!dst->user_cpus_ptr) return -ENOMEM; + /* Use pi_lock to protect content of user_cpus_ptr */ + raw_spin_lock_irqsave(&src->pi_lock, flags); cpumask_copy(dst->user_cpus_ptr, src->user_cpus_ptr); + raw_spin_unlock_irqrestore(&src->pi_lock, flags); return 0; } -- 2.31.1
| |