psi: Fix OOB write when writing 0 bytes to psi files
Subsystems (2)
Suren Baghdasaryan
maintainerPATCH 1/1 psi: Fix OOB write when writing 0 bytes to psi files
Issuing write() with count parameter set to 0 on any file under /proc/pressure/ will cause an OOB write because of the access to buf[buf_size-1] when NUL-termination is performed. Fix this by checking for buf_size to be non-zero.
--- kernel/sched/psi.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/sched/psi.c +3 -0
@@ -1199,6 +1199,9 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,if (static_branch_likely (&psi_disabled))return -EOPNOTSUPP ; +if (!nbytes) +return -EINVAL ; + buf_size =min (nbytes,sizeof (buf));if (copy_from_user (buf, user_buf, buf_size))return -EFAULT ;
Signature · 1 line
2.25.0.341.g760bfbb309-goog
Quoted 6 lines · Suren Baghdasaryan
Issuing
write()with count parameter set to 0 on any file under/proc/pressure/will cause an OOB write because of the access to buf[buf_size-1] when NUL-termination is performed. Fix this by checking forbuf_sizeto be non-zero.Signed-off-by Suren Baghdasaryan <[email protected]>
Thanks Suren.
Peter Zijlstra
maintainerQuoted 9 lines · Johannes Weiner
Quoted 6 lines · Suren Baghdasaryan
Issuing
write()with count parameter set to 0 on any file under/proc/pressure/will cause an OOB write because of the access to buf[buf_size-1] when NUL-termination is performed. Fix this by checking forbuf_sizeto be non-zero.Signed-off-by Suren Baghdasaryan <[email protected]>Acked-by Johannes Weiner <[email protected]>
Thanks!
[tip: sched/urgent] sched/psi: Fix OOB write when writing 0 bytes to PSI files
In reply to Suren BaghdasaryanThe following commit has been merged into the sched/urgent branch of tip:
The following commit has been merged into the sched/urgent branch of tip:
Commit-ID: 6fcca0fa48118e6d63733eb4644c6cd880c15b8f Gitweb: https://git.kernel.org/tip/6fcca0fa48118e6d63733eb4644c6cd880c15b8f Author: Suren Baghdasaryan <[email protected]> AuthorDate: Mon, 03 Feb 2020 13:22:16 -08:00 Committer: Ingo Molnar <[email protected]> CommitterDate: Tue, 11 Feb 2020 13:00:02 +01:00
sched/psi: Fix OOB write when writing 0 bytes to PSI files
Issuing write() with count parameter set to 0 on any file under /proc/pressure/ will cause an OOB write because of the access to buf[buf_size-1] when NUL-termination is performed. Fix this by checking for buf_size to be non-zero.
--- kernel/sched/psi.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/sched/psi.c +3 -0
@@ -1199,6 +1199,9 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,if (static_branch_likely (&psi_disabled))return -EOPNOTSUPP ; +if (!nbytes) +return -EINVAL ; + buf_size =min (nbytes,sizeof (buf));if (copy_from_user (buf, user_buf, buf_size))return -EFAULT ;