Re: [BUG] taskstats: REGISTER_CPUMASK silently truncates the last byte of the cpumask string

[Andrew Morton]

On Tue, 21 Jul 2026 15:52:33 +0300 Oleg Deomi <oleg.deomi@xxxxxxxxx> wrote:

> TASKSTATS REGISTER_CPUMASK silently drops the last byte of the cpumask
> string it's given, due to a destination-buffer-sizing bug in
> kernel/taskstats.c's parse(). A request for "0-31" is silently parsed as
> "0-3" instead — the call still succeeds (ACK, no error), so the caller
> has no way to detect that most of the CPUs it asked to cover were never
> actually registered.

Thanks, I queued this fix:


From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Subject: kernel/taskstats.c:parse(): fix buffer allocation size
Date: Tue Jul 21 04:30:41 PM PDT 2026

parse() is failing to allow for the nla_strscpy()'s null termination of
the cpumask string.  This can result in the cpumask string being
truncated.

This can result in an inappropriate -EINVAL failure or in reporting for an
incorrect span of CPUs.

Fixes: f9fd8914c1ac ("[PATCH] per-task delay accounting taskstats interface: control exit data through cpumasks")
Reported-by: Oleg Deomi <oleg.deomi@xxxxxxxxx>
Closes: https://lore.kernel.org/CAByWkfZ6b1=3H9pwkz-dDQOs9cZaF-HYQ6b9Yb0=Hq2r1Vv_Pw@xxxxxxxxxxxxxx
Cc: Balbir Singh <bsingharora@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 kernel/taskstats.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/taskstats.c~a
+++ a/kernel/taskstats.c
@@ -368,7 +368,7 @@ static int parse(struct nlattr *na, stru
 		return -E2BIG;
 	if (len < 1)
 		return -EINVAL;
-	data = kmalloc(len, GFP_KERNEL);
+	data = kmalloc(len + 1, GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 	nla_strscpy(data, na, len);
_