From b2f8b495ad73edb34d47154eba9535a14bd32d61 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Wed, 1 Dec 2021 17:53:47 -0800 Subject: [PATCH] cgroup/cpuset: handle the offset argument of write methods properly offset is an offset in a file, so here is no sense to drop first "offset" number of bytes from a buffer. Reported-by: syzbot+b9610cff22c10d9bead4@syzkaller.appspotmail.com PiperOrigin-RevId: 413553935 --- pkg/sentry/fsimpl/cgroupfs/base.go | 3 +-- pkg/sentry/fsimpl/cgroupfs/cpuset.go | 2 -- pkg/sentry/fsimpl/cgroupfs/job.go | 2 +- 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/pkg/sentry/fsimpl/cgroupfs/base.go b/pkg/sentry/fsimpl/cgroupfs/base.go index 71bb0a9c8..c68085fbc 100644 --- a/pkg/sentry/fsimpl/cgroupfs/base.go +++ b/pkg/sentry/fsimpl/cgroupfs/base.go @@ -234,11 +234,10 @@ func (d *tasksData) Write(ctx context.Context, src usermem.IOSequence, offset in // parseInt64FromString interprets src as string encoding a int64 value, and // returns the parsed value. -func parseInt64FromString(ctx context.Context, src usermem.IOSequence, offset int64) (val, len int64, err error) { +func parseInt64FromString(ctx context.Context, src usermem.IOSequence) (val, len int64, err error) { const maxInt64StrLen = 20 // i.e. len(fmt.Sprintf("%d", math.MinInt64)) == 20 t := kernel.TaskFromContext(ctx) - src = src.DropFirst64(offset) buf := t.CopyScratchBuffer(maxInt64StrLen) n, err := src.CopyIn(ctx, buf) diff --git a/pkg/sentry/fsimpl/cgroupfs/cpuset.go b/pkg/sentry/fsimpl/cgroupfs/cpuset.go index 913dde1f7..0f1990ba4 100644 --- a/pkg/sentry/fsimpl/cgroupfs/cpuset.go +++ b/pkg/sentry/fsimpl/cgroupfs/cpuset.go @@ -82,7 +82,6 @@ func (d *cpusData) Generate(ctx context.Context, buf *bytes.Buffer) error { // Write implements vfs.WritableDynamicBytesSource.Write. func (d *cpusData) Write(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) { - src = src.DropFirst64(offset) if src.NumBytes() > hostarch.PageSize { return 0, linuxerr.EINVAL } @@ -127,7 +126,6 @@ func (d *memsData) Generate(ctx context.Context, buf *bytes.Buffer) error { // Write implements vfs.WritableDynamicBytesSource.Write. func (d *memsData) Write(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) { - src = src.DropFirst64(offset) if src.NumBytes() > hostarch.PageSize { return 0, linuxerr.EINVAL } diff --git a/pkg/sentry/fsimpl/cgroupfs/job.go b/pkg/sentry/fsimpl/cgroupfs/job.go index 48919c338..3b2067007 100644 --- a/pkg/sentry/fsimpl/cgroupfs/job.go +++ b/pkg/sentry/fsimpl/cgroupfs/job.go @@ -55,7 +55,7 @@ func (d *jobIDData) Generate(ctx context.Context, buf *bytes.Buffer) error { // Write implements vfs.WritableDynamicBytesSource.Write. func (d *jobIDData) Write(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) { - val, n, err := parseInt64FromString(ctx, src, offset) + val, n, err := parseInt64FromString(ctx, src) if err != nil { return n, err }