diff options
| author | Mark Harris <mark.hsj@gmail.com> | 2026-07-13 17:30:56 -0700 |
|---|---|---|
| committer | Paul Walmsley <pjw@kernel.org> | 2026-07-15 11:12:40 -0600 |
| commit | 5caae1deee89a6582c761d5dcd4b924b744426cc (patch) | |
| tree | bd57a304bc1594f2e37a10b2c3bac1748874039d | |
| parent | e4bf6eb4c7b61db1cf24487e14e6ae8755e61e3d (diff) | |
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
When cpusetsize < cpumask_size(), hwprobe_get_cpus() did not fully
initialize its copy of the cpu mask, which could cause non-deterministic
results from the riscv_hwprobe syscall on a system with more than 8 CPUs
when the supplied cpu mask is empty. Address this by fully initializing
the cpu mask.
Fixes: e178bf146e4b ("RISC-V: hwprobe: Introduce which-cpus flag")
Signed-off-by: Mark Harris <mark.hsj@gmail.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Reviewed-by: Michael Ellerman <mpe@kernel.org>
Link: https://patch.msgid.link/20260714003056.73707-1-mark.hsj@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
| -rw-r--r-- | arch/riscv/kernel/sys_hwprobe.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/riscv/kernel/sys_hwprobe.c b/arch/riscv/kernel/sys_hwprobe.c index 1659d31fd288..caf6762427c8 100644 --- a/arch/riscv/kernel/sys_hwprobe.c +++ b/arch/riscv/kernel/sys_hwprobe.c @@ -450,6 +450,7 @@ static int hwprobe_get_cpus(struct riscv_hwprobe __user *pairs, if (cpusetsize > cpumask_size()) cpusetsize = cpumask_size(); + cpumask_clear(&cpus); ret = copy_from_user(&cpus, cpus_user, cpusetsize); if (ret) return -EFAULT; |