On Thu, 25 Sep 2025 23:17:36 +0200
Thorsten Blum <[email protected]> wrote:


>  #ifdef CONFIG_X86_LOCAL_APIC
> @@ -2325,12 +2326,9 @@ osnoise_cpus_write(struct file *filp, const char 
> __user *ubuf, size_t count,
>       if (count < 1)
>               return 0;
>  
> -     buf = kmalloc(count, GFP_KERNEL);
> -     if (!buf)
> -             return -ENOMEM;
> -
> -     if (copy_from_user(buf, ubuf, count))
> -             return -EFAULT;
> +     buf = memdup_user(ubuf, count);
> +     if (IS_ERR(buf))
> +             return PTR_ERR(buf);

After adding this to my for-next branch, it failed to merge with upstream.
That's because a bug was found that if user space did not have a '\0'
terminator, reading this as a string could cause the read to go off the
allocated buffer and crash the machine.

>  
>       if (!zalloc_cpumask_var(&osnoise_cpumask_new, GFP_KERNEL))
>               return -ENOMEM;

The above was changed to this:

        if (count < 1)
                return 0;

        buf = kmalloc(count + 1, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;

        if (copy_from_user(buf, ubuf, count))
                return -EFAULT;
        buf[count] = '\0';

Which makes your change not quite compatible.

I'm going to rebase and remove your change for now.

-- Steve

Reply via email to