Patch "sched/fair: Null terminate buffer when updating tunable_scaling" has been added to the 5.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    sched/fair: Null terminate buffer when updating tunable_scaling

to the 5.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sched-fair-null-terminate-buffer-when-updating-tunab.patch
and it can be found in the queue-5.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 241f7fa422b24c4b9267acb8f620a971c7703310
Author: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx>
Date:   Mon Sep 27 12:46:35 2021 +0100

    sched/fair: Null terminate buffer when updating tunable_scaling
    
    [ Upstream commit 703066188f63d66cc6b9d678e5b5ef1213c5938e ]
    
    This patch null-terminates the temporary buffer in sched_scaling_write()
    so kstrtouint() does not return failure and checks the value is valid.
    
    Before:
      $ cat /sys/kernel/debug/sched/tunable_scaling
      1
      $ echo 0 > /sys/kernel/debug/sched/tunable_scaling
      -bash: echo: write error: Invalid argument
      $ cat /sys/kernel/debug/sched/tunable_scaling
      1
    
    After:
      $ cat /sys/kernel/debug/sched/tunable_scaling
      1
      $ echo 0 > /sys/kernel/debug/sched/tunable_scaling
      $ cat /sys/kernel/debug/sched/tunable_scaling
      0
      $ echo 3 > /sys/kernel/debug/sched/tunable_scaling
      -bash: echo: write error: Invalid argument
    
    Fixes: 8a99b6833c88 ("sched: Move SCHED_DEBUG sysctl to debugfs")
    Signed-off-by: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
    Acked-by: Vincent Guittot <vincent.guittot@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20210927114635.GH3959@xxxxxxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 7e08e3d947c2..2c879cd02a5f 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -173,16 +173,22 @@ static ssize_t sched_scaling_write(struct file *filp, const char __user *ubuf,
 				   size_t cnt, loff_t *ppos)
 {
 	char buf[16];
+	unsigned int scaling;
 
 	if (cnt > 15)
 		cnt = 15;
 
 	if (copy_from_user(&buf, ubuf, cnt))
 		return -EFAULT;
+	buf[cnt] = '\0';
 
-	if (kstrtouint(buf, 10, &sysctl_sched_tunable_scaling))
+	if (kstrtouint(buf, 10, &scaling))
 		return -EINVAL;
 
+	if (scaling >= SCHED_TUNABLESCALING_END)
+		return -EINVAL;
+
+	sysctl_sched_tunable_scaling = scaling;
 	if (sched_update_scaling())
 		return -EINVAL;