From: Dan Carpenter <dan.carpenter@oracle.com> To: "David S. Miller" <davem@davemloft.net>, Alexander Viro <viro@zeniv.linux.org.uk>, Jens Axboe <axboe@kernel.dk> Cc: Amritha Nambiar <amritha.nambiar@intel.com>, Willem de Bruijn <willemb@google.com>, kernel-janitors@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Zijlstra <peterz@infradead.org> Subject: [PATCH v2 1/2] cpumask: Introduce possible_cpu_safe() Date: Mon, 8 Apr 2019 11:09:50 +0300 [thread overview] Message-ID: <20190408080950.GA15239@kadam> (raw) In-Reply-To: <20190404104527.GX4038@hirez.programming.kicks-ass.net> There have been two cases recently where we pass user a controlled "cpu" to possible_cpus(). That's not allowed. If it's invalid, it will trigger a WARN_ONCE() and an out of bounds read which could result in an Oops. This patch introduces possible_cpu_safe() which first checks to see if the cpu is valid, turns off speculation and then checks if the cpu is possible. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: Use nr_cpumask_bits instead of NR_CPUS. Split cpumask_validate_cpu() into a separate function. I still left cpumask_test_cpu_safe() return 0 for invalid cpus, instead of returning -ERANGE I feel it's simpler to stay consistent with the normal possible_cpu() function. include/linux/cpumask.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h index 147bdec42215..f371e44cb5ff 100644 --- a/include/linux/cpumask.h +++ b/include/linux/cpumask.h @@ -11,6 +11,7 @@ #include <linux/threads.h> #include <linux/bitmap.h> #include <linux/bug.h> +#include <linux/nospec.h> /* Don't assign or return these: may not be this big! */ typedef struct cpumask { DECLARE_BITMAP(bits, NR_CPUS); } cpumask_t; @@ -102,6 +103,7 @@ extern struct cpumask __cpu_active_mask; #define num_active_cpus() cpumask_weight(cpu_active_mask) #define cpu_online(cpu) cpumask_test_cpu((cpu), cpu_online_mask) #define cpu_possible(cpu) cpumask_test_cpu((cpu), cpu_possible_mask) +#define cpu_possible_safe(cpu) cpumask_test_cpu_safe((cpu), cpu_possible_mask) #define cpu_present(cpu) cpumask_test_cpu((cpu), cpu_present_mask) #define cpu_active(cpu) cpumask_test_cpu((cpu), cpu_active_mask) #else @@ -111,6 +113,7 @@ extern struct cpumask __cpu_active_mask; #define num_active_cpus() 1U #define cpu_online(cpu) ((cpu) == 0) #define cpu_possible(cpu) ((cpu) == 0) +#define cpu_possible_safe(cpu) ((cpu) == 0) #define cpu_present(cpu) ((cpu) == 0) #define cpu_active(cpu) ((cpu) == 0) #endif @@ -344,6 +347,28 @@ static inline int cpumask_test_cpu(int cpu, const struct cpumask *cpumask) return test_bit(cpumask_check(cpu), cpumask_bits((cpumask))); } +static inline unsigned int cpumask_validate_cpu(unsigned int cpu) +{ + if (cpu >= nr_cpumask_bits) + return nr_cpumask_bits; + return array_index_nospec(cpu, nr_cpumask_bits); +} + +/** + * cpumask_test_cpu_safe - test for a cpu in a cpumask + * @cpu: cpu number + * @cpumask: the cpumask pointer + * + * Returns 1 if @cpu is valid and set in @cpumask, else returns 0 + */ +static inline int cpumask_test_cpu_safe(int cpu, const struct cpumask *cpumask) +{ + cpu = cpumask_validate_cpu(cpu); + if (cpu >= nr_cpu_ids) + return 0; + return test_bit(cpu, cpumask_bits(cpumask)); +} + /** * cpumask_test_and_set_cpu - atomically test and set a cpu in a cpumask * @cpu: cpu number (< nr_cpu_ids) -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com> To: "David S. Miller" <davem@davemloft.net>, Alexander Viro <viro@zeniv.linux.org.uk>, Jens Axboe <axboe@kernel.dk> Cc: Amritha Nambiar <amritha.nambiar@intel.com>, Willem de Bruijn <willemb@google.com>, kernel-janitors@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Zijlstra <peterz@infradead.org> Subject: [PATCH v2 1/2] cpumask: Introduce possible_cpu_safe() Date: Mon, 08 Apr 2019 08:09:50 +0000 [thread overview] Message-ID: <20190408080950.GA15239@kadam> (raw) In-Reply-To: <20190404104527.GX4038@hirez.programming.kicks-ass.net> There have been two cases recently where we pass user a controlled "cpu" to possible_cpus(). That's not allowed. If it's invalid, it will trigger a WARN_ONCE() and an out of bounds read which could result in an Oops. This patch introduces possible_cpu_safe() which first checks to see if the cpu is valid, turns off speculation and then checks if the cpu is possible. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: Use nr_cpumask_bits instead of NR_CPUS. Split cpumask_validate_cpu() into a separate function. I still left cpumask_test_cpu_safe() return 0 for invalid cpus, instead of returning -ERANGE I feel it's simpler to stay consistent with the normal possible_cpu() function. include/linux/cpumask.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h index 147bdec42215..f371e44cb5ff 100644 --- a/include/linux/cpumask.h +++ b/include/linux/cpumask.h @@ -11,6 +11,7 @@ #include <linux/threads.h> #include <linux/bitmap.h> #include <linux/bug.h> +#include <linux/nospec.h> /* Don't assign or return these: may not be this big! */ typedef struct cpumask { DECLARE_BITMAP(bits, NR_CPUS); } cpumask_t; @@ -102,6 +103,7 @@ extern struct cpumask __cpu_active_mask; #define num_active_cpus() cpumask_weight(cpu_active_mask) #define cpu_online(cpu) cpumask_test_cpu((cpu), cpu_online_mask) #define cpu_possible(cpu) cpumask_test_cpu((cpu), cpu_possible_mask) +#define cpu_possible_safe(cpu) cpumask_test_cpu_safe((cpu), cpu_possible_mask) #define cpu_present(cpu) cpumask_test_cpu((cpu), cpu_present_mask) #define cpu_active(cpu) cpumask_test_cpu((cpu), cpu_active_mask) #else @@ -111,6 +113,7 @@ extern struct cpumask __cpu_active_mask; #define num_active_cpus() 1U #define cpu_online(cpu) ((cpu) = 0) #define cpu_possible(cpu) ((cpu) = 0) +#define cpu_possible_safe(cpu) ((cpu) = 0) #define cpu_present(cpu) ((cpu) = 0) #define cpu_active(cpu) ((cpu) = 0) #endif @@ -344,6 +347,28 @@ static inline int cpumask_test_cpu(int cpu, const struct cpumask *cpumask) return test_bit(cpumask_check(cpu), cpumask_bits((cpumask))); } +static inline unsigned int cpumask_validate_cpu(unsigned int cpu) +{ + if (cpu >= nr_cpumask_bits) + return nr_cpumask_bits; + return array_index_nospec(cpu, nr_cpumask_bits); +} + +/** + * cpumask_test_cpu_safe - test for a cpu in a cpumask + * @cpu: cpu number + * @cpumask: the cpumask pointer + * + * Returns 1 if @cpu is valid and set in @cpumask, else returns 0 + */ +static inline int cpumask_test_cpu_safe(int cpu, const struct cpumask *cpumask) +{ + cpu = cpumask_validate_cpu(cpu); + if (cpu >= nr_cpu_ids) + return 0; + return test_bit(cpu, cpumask_bits(cpumask)); +} + /** * cpumask_test_and_set_cpu - atomically test and set a cpu in a cpumask * @cpu: cpu number (< nr_cpu_ids) -- 2.17.1
next prev parent reply other threads:[~2019-04-08 8:12 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-04 10:02 [PATCH 1/2] cpumask: Introduce possible_cpu_safe() Dan Carpenter 2019-04-04 10:02 ` Dan Carpenter 2019-04-04 10:04 ` [PATCH 2/2] io_uring: Potential Oops in io_sq_offload_start() Dan Carpenter 2019-04-04 10:04 ` Dan Carpenter 2019-04-04 10:35 ` [PATCH 1/2] cpumask: Introduce possible_cpu_safe() Michal Hocko 2019-04-04 10:35 ` Michal Hocko 2019-04-04 11:28 ` Peter Zijlstra 2019-04-04 11:28 ` Peter Zijlstra 2019-04-04 10:45 ` Peter Zijlstra 2019-04-04 10:45 ` Peter Zijlstra 2019-04-08 8:09 ` Dan Carpenter [this message] 2019-04-08 8:09 ` [PATCH v2 " Dan Carpenter 2019-04-08 8:15 ` [PATCH v2 2/2] io_uring: Potential Oops in io_sq_offload_start() Dan Carpenter 2019-04-08 8:15 ` Dan Carpenter 2019-04-30 9:26 ` Dan Carpenter 2019-04-30 9:26 ` Dan Carpenter 2019-05-03 11:43 ` Dan Carpenter 2019-05-03 11:43 ` Dan Carpenter
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190408080950.GA15239@kadam \ --to=dan.carpenter@oracle.com \ --cc=amritha.nambiar@intel.com \ --cc=axboe@kernel.dk \ --cc=davem@davemloft.net \ --cc=kernel-janitors@vger.kernel.org \ --cc=linux-block@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=peterz@infradead.org \ --cc=viro@zeniv.linux.org.uk \ --cc=willemb@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.