anierin/msm-5.15
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "FROMLIST: sched: Fix use-after-free bug in dup_user_cpus_ptr()"

Browse Source 
This reverts commit 28f65c4aa3.

This patch gets in the way of reverting the sched_setaffinity() changes
which were backported from 6.2-rc. Revert it for now -- we'll bring it
back later using the commit from -stable.

Signed-off-by: Will Deacon <willdeacon@google.com>
Bug: 263926519
Bug: 264940090
Change-Id: Iec078ad43db28d7be8d4eb49368f5c40f0ff4b7e
This commit is contained in:
Will Deacon
2023-02-06 12:37:50 +00:00
parent bd82038474
commit 92bd55bc52
1 changed files with 4 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
kernel/sched/core.c
View File

@@ -2589,43 +2589,19 @@ void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask)
int dup_user_cpus_ptr(struct task_struct *dst, struct task_struct *src,
int node)
{
cpumask_t *user_mask;
unsigned long flags;
/*
* Always clear dst->user_cpus_ptr first as their user_cpus_ptr's
* may differ by now due to racing.
*/
dst->user_cpus_ptr = NULL;
/*
* This check is racy and losing the race is a valid situation.
* It is not worth the extra overhead of taking the pi_lock on
* every fork/clone.
*/
if (!src->user_cpus_ptr)
return 0;
user_mask = kmalloc_node(cpumask_size(), GFP_KERNEL, node);
if (!user_mask)
dst->user_cpus_ptr = kmalloc_node(cpumask_size(), GFP_KERNEL, node);
if (!dst->user_cpus_ptr)
return -ENOMEM;
/*
* Use pi_lock to protect content of user_cpus_ptr
*
* Though unlikely, user_cpus_ptr can be reset to NULL by a concurrent
* do_set_cpus_allowed().
*/
/* Use pi_lock to protect content of user_cpus_ptr */
raw_spin_lock_irqsave(&src->pi_lock, flags);
if (src->user_cpus_ptr) {
swap(dst->user_cpus_ptr, user_mask);
cpumask_copy(dst->user_cpus_ptr, src->user_cpus_ptr);
}
cpumask_copy(dst->user_cpus_ptr, src->user_cpus_ptr);
raw_spin_unlock_irqrestore(&src->pi_lock, flags);
if (unlikely(user_mask))
kfree(user_mask);
return 0;
}