Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

mm: take into account mm_cid size for mm_struct static definitions

Both init_mm and efi_mm static definitions need to make room for the 2
mm_cid cpumasks.

This fixes possible out-of-bounds accesses to init_mm and efi_mm.

Add a space between # and define for the mm_alloc_cid() definition to make
it consistent with the coding style used in the rest of this header file.

Link: https://lkml.kernel.org/r/20251224173358.647691-4-mathieu.desnoyers@efficios.com
Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Liam R . Howlett" <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Martin Liu <liumartin@google.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: SeongJae Park <sj@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Mathieu Desnoyers and committed by
Andrew Morton
be31340a 6ac433f8

+5 -2
+5 -2
include/linux/mm_types.h
··· 1368 1368 1369 1369 #define MM_STRUCT_FLEXIBLE_ARRAY_INIT \ 1370 1370 { \ 1371 - [0 ... sizeof(cpumask_t)-1] = 0 \ 1371 + [0 ... sizeof(cpumask_t) + MM_CID_STATIC_SIZE - 1] = 0 \ 1372 1372 } 1373 1373 1374 1374 /* Pointer magic because the dynamic array size confuses some compilers. */ ··· 1500 1500 mm_init_cid(mm, p); 1501 1501 return 0; 1502 1502 } 1503 - #define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) 1503 + # define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) 1504 1504 1505 1505 static inline void mm_destroy_cid(struct mm_struct *mm) 1506 1506 { ··· 1514 1514 return cpumask_size() + bitmap_size(num_possible_cpus()); 1515 1515 } 1516 1516 1517 + /* Use 2 * NR_CPUS as worse case for static allocation. */ 1518 + # define MM_CID_STATIC_SIZE (2 * sizeof(cpumask_t)) 1517 1519 #else /* CONFIG_SCHED_MM_CID */ 1518 1520 static inline void mm_init_cid(struct mm_struct *mm, struct task_struct *p) { } 1519 1521 static inline int mm_alloc_cid(struct mm_struct *mm, struct task_struct *p) { return 0; } ··· 1524 1522 { 1525 1523 return 0; 1526 1524 } 1525 + # define MM_CID_STATIC_SIZE 0 1527 1526 #endif /* CONFIG_SCHED_MM_CID */ 1528 1527 1529 1528 struct mmu_gather;