Messages in this thread | | | Date | Fri, 7 Jul 2023 16:28:51 -0400 | From | Joe Korty <> | Subject | [BUG 6.4] sched/core: Possible buffer overflow in do_set_cpu_allowed |
| |
In commit 9a5418bc48bab ("sched/core: Use kfree_rcu() in do_set_cpus_allowed()"), a kfree_rcu() is used to free a cpu mask. However, cpu masks can be as short as 8 bytes and this is a problem, as kfree_rcu requires the to-be freed buffer to be at least 16 bytes. Thus there is a chance of buffer overflow corruption when the number of possible cpus in the system is 64 or less.
I have not seen this corruption in the wild. I only noticed this possibility when reviewing the scheduler differences between 6.1 and 6.4.
Regards, Joe Korty
| |