This patch addresses a critical memory management flaw. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer. Consequently, sizeof(new_mask) evaluates to the pointer size, causing copy_from_user() to clobber the stack pointer. The subsequent alloc_cpumask_var() overwrites this with an uninitialised heap address, discarding the user's mask and risking data leaks. Fix this by allocating masks first, and using cpumask_size() to copy data directly into the allocated buffer. Additionally, reorder the failure goto labels to ensure task locks and memory allocations are cleanly unwound. Fixes: 295cbf6d63165 ("[MIPS] Move FPU affinity code into separate file.") Cc: stable@vger.kernel.org Signed-off-by: Aaron Tomlin --- arch/mips/kernel/mips-mt-fpaff.c | 39 ++++++++++++++++---------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c index a6a61393fc1a..4b3424088302 100644 --- a/arch/mips/kernel/mips-mt-fpaff.c +++ b/arch/mips/kernel/mips-mt-fpaff.c @@ -71,11 +71,23 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, struct task_struct *p; int retval; - if (len < sizeof(new_mask)) + if (len < cpumask_size()) return -EINVAL; - if (copy_from_user(&new_mask, user_mask_ptr, sizeof(new_mask))) - return -EFAULT; + if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) + return -ENOMEM; + if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) { + retval = -ENOMEM; + goto out_free_cpus_allowed; + } + if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) { + retval = -ENOMEM; + goto out_free_new_mask; + } + + retval = -EFAULT; + if (copy_from_user(new_mask, user_mask_ptr, cpumask_size())) + goto out_free_effective_mask; cpus_read_lock(); rcu_read_lock(); @@ -84,25 +96,14 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, if (!p) { rcu_read_unlock(); cpus_read_unlock(); - return -ESRCH; + retval = -ESRCH; + goto out_free_effective_mask; } /* Prevent p going away */ get_task_struct(p); rcu_read_unlock(); - if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) { - retval = -ENOMEM; - goto out_put_task; - } - if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) { - retval = -ENOMEM; - goto out_free_cpus_allowed; - } - if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) { - retval = -ENOMEM; - goto out_free_new_mask; - } if (!check_same_owner(p) && !capable(CAP_SYS_NICE)) { retval = -EPERM; goto out_unlock; @@ -141,14 +142,14 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len, } } out_unlock: + put_task_struct(p); + cpus_read_unlock(); +out_free_effective_mask: free_cpumask_var(effective_mask); out_free_new_mask: free_cpumask_var(new_mask); out_free_cpus_allowed: free_cpumask_var(cpus_allowed); -out_put_task: - put_task_struct(p); - cpus_read_unlock(); return retval; } -- 2.51.0