Skip to contentSkip to conversation

memcg_write_event_control(): fix a user-triggerable oops

PATCH In review Al Viro 2 participants 5 messages Jul 26, 2024

Subsystems (3)
Memory management cgroup memcg
lore
Share & tools
lore

Al Viro

author
#0 lore raw

PATCH 1/1 memcg_write_event_control(): fix a user-triggerable oops

We are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

Signed-off-by Al Viro <[email protected]>

---

mm/memcontrol-v1.c +5 -2
index 2aeea4d8bf8e..417c96f2da28 100644
@@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
 	buf = endp + 1;
 
 	cfd = simple_strtoul(buf, &endp, 10);
-	if ((*endp != ' ') && (*endp != '\0'))
+	if (*endp == '\0')
+		buf = endp;
+	else if (*endp == ' ')
+		buf = endp + 1;
+	else
 		return -EINVAL;
-	buf = endp + 1;
 
 	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (!event)
Acked-by on v1 1/1
#1 lore raw
Quoted 3 lines · Al Viro

We are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

Fixes 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications")
Quoted 1 line
Signed-off-by Al Viro <[email protected]>
Acked-by Michal Hocko <[email protected]>
Quoted 20 lines

---

mm/memcontrol-v1.c +5 -2
index 2aeea4d8bf8e..417c96f2da28 100644
@@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
 	buf = endp + 1;
 
 	cfd = simple_strtoul(buf, &endp, 10);
-	if ((*endp != ' ') && (*endp != '\0'))
+	if (*endp == '\0')
+		buf = endp;
+	else if (*endp == ' ')
+		buf = endp + 1;
+	else
 		return -EINVAL;
-	buf = endp + 1;
 
 	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (!event)
Signature · 2 lines
Michal Hocko
SUSE Labs
#2 lore raw
Quoted 10 lines · Michal Hocko
Quoted 3 lines · Al Viro

We are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

Fixes 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications")
Quoted 1 line
Signed-off-by Al Viro <[email protected]>
Acked-by Michal Hocko <[email protected]>

Btw. this should be
Cc: stable

Quoted 25 lines
Quoted 21 lines

---

mm/memcontrol-v1.c +5 -2
index 2aeea4d8bf8e..417c96f2da28 100644
@@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
 	buf = endp + 1;
 
 	cfd = simple_strtoul(buf, &endp, 10);
-	if ((*endp != ' ') && (*endp != '\0'))
+	if (*endp == '\0')
+		buf = endp;
+	else if (*endp == ' ')
+		buf = endp + 1;
+	else
 		return -EINVAL;
-	buf = endp + 1;
 
 	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (!event)
Signature · 2 lines
Michal Hocko
SUSE Labs
Signature · 2 lines
Michal Hocko
SUSE Labs
author
#3 lore raw
Quoted 6 lines · Michal Hocko
Quoted 5 lines · Michal Hocko
Quoted 3 lines · Al Viro

We are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

Quoted 8 lines
Quoted 5 lines
Fixes 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications")
Quoted 1 line
Signed-off-by Al Viro <[email protected]>
Acked-by Michal Hocko <[email protected]>

Btw. this should be
Cc: stable

Point, except that for -stable it needs to be applied to mm/memcontrol.c instead...

#4 lore raw
Quoted 11 lines · Al Viro
Quoted 10 lines · Michal Hocko
Quoted 9 lines · Michal Hocko
Quoted 3 lines · Al Viro

We are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

Fixes 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications")
Quoted 1 line
Signed-off-by Al Viro <[email protected]>
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Acked-by Michal Hocko <[email protected]>

Btw. this should be
Cc: stable

Point, except that for -stable it needs to be applied to mm/memcontrol.c instead...

Correct. And if anybody wants to backport to pre 3.14 then to kernel/cgroup.c

Signature · 2 lines
Michal Hocko
SUSE Labs