lkml.org 
[lkml]   [2019]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] sched: fix a potential double-fetch bug in sched_copy_attr
On Tue, Dec 25, 2018 at 04:16:47PM -0600, Kangjie Lu wrote:
> "uattr->size" is copied in from user space and checked. However, it is
> copied in again after the security check. A malicious user may race to
> change it. The fix checks if uattr->size is ever changed after the
> check.
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---

> + /* Sanity check if size was changed in user space */
> + if (attr->size != size)
> + return -EINVAL;
> +

What perf_copy_attr() does (from whence we copied this code) is:

attr->size = size;

Would that not also fix things?

\
 
 \ /
  Last update: 2019-01-07 18:26    [from the cache]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog