| Message ID | 1476451342-146510-1-git-send-email-dvyukov@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Oct 14, 2016 at 3:22 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > Size of kmalloc() in vga_arb_write() is controlled by user. > Too large kmalloc() size triggers WARNING message on console. > Allocate the buffer on stack to avoid the WARNING. > The string must be small (e.g "target PCI:domain:bus:dev.fn"). > > Signed-off-by: Dmitry Vyukov <dvyukov@google.com> > Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> > Cc: Dave Airlie <airlied@gmail.com> > Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> > Cc: dri-devel@lists.freedesktop.org > Cc: syzkaller@googlegroups.com Ping, this is still not merged. David, please take this to dri tree. > --- > > Changes since v1: > - removed another kfree(kbuf) > > I've sent a patch that adds __GFP_NOWARN to the kmalloc a while ago: > https://groups.google.com/forum/#!msg/syzkaller/navdAwe4iCo/mZDhODsnAAAJ > > Ville suggested to allocate the buffer on stack as it must be small: > > "From the looks of things the longest command could be the > "target PCI:domain:bus:dev.fn" thing. Even assuming something silly like > having 10 characters for each domain,bus,dev,fn that would still be only > 55 bytes. So based on that even something like 64 bytes should be more > than enough AFAICS. " > > Example WARNING: > > WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999 > __alloc_pages_nodemask+0x7d2/0x1760() > Modules linked in: > CPU: 2 PID: 29322 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #283 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > 00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000 > ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9 > ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0 > Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 > [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 > [<ffffffff8134ff29>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 > [< inline >] __alloc_pages_slowpath mm/page_alloc.c:2999 > [<ffffffff8166de32>] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253 > [<ffffffff81745c99>] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090 > [< inline >] alloc_pages include/linux/gfp.h:459 > [<ffffffff81669bb6>] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433 > [<ffffffff816c20af>] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008 > [<ffffffff816c212f>] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019 > [< inline >] kmalloc_large include/linux/slab.h:395 > [<ffffffff81756b24>] __kmalloc+0x2f4/0x340 mm/slub.c:3557 > [< inline >] kmalloc include/linux/slab.h:468 > [<ffffffff832c65a4>] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926 > [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719 > [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849 > [<ffffffff817ad8b6>] vfs_writev+0x86/0xc0 fs/read_write.c:886 > [< inline >] SYSC_writev fs/read_write.c:919 > [<ffffffff817b0a21>] SyS_writev+0x111/0x2b0 fs/read_write.c:911 > [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a > arch/x86/entry/entry_64.S:185 > --- > drivers/gpu/vga/vgaarb.c | 15 ++++----------- > 1 file changed, 4 insertions(+), 11 deletions(-) > > diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c > index 1887f19..77657a8 100644 > --- a/drivers/gpu/vga/vgaarb.c > +++ b/drivers/gpu/vga/vgaarb.c > @@ -1022,21 +1022,16 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, > > unsigned int io_state; > > - char *kbuf, *curr_pos; > + char kbuf[64], *curr_pos; > size_t remaining = count; > > int ret_val; > int i; > > - > - kbuf = kmalloc(count + 1, GFP_KERNEL); > - if (!kbuf) > - return -ENOMEM; > - > - if (copy_from_user(kbuf, buf, count)) { > - kfree(kbuf); > + if (count >= sizeof(kbuf)) > + return -EINVAL; > + if (copy_from_user(kbuf, buf, count)) > return -EFAULT; > - } > curr_pos = kbuf; > kbuf[count] = '\0'; /* Just to make sure... */ > > @@ -1259,11 +1254,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, > goto done; > } > /* If we got here, the message written is not part of the protocol! */ > - kfree(kbuf); > return -EPROTO; > > done: > - kfree(kbuf); > return ret_val; > } > > -- > 2.8.0.rc3.226.g39d4020 >
On Mon, Nov 14, 2016 at 10:11:47AM +0100, Dmitry Vyukov wrote: > On Fri, Oct 14, 2016 at 3:22 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > > Size of kmalloc() in vga_arb_write() is controlled by user. > > Too large kmalloc() size triggers WARNING message on console. > > Allocate the buffer on stack to avoid the WARNING. > > The string must be small (e.g "target PCI:domain:bus:dev.fn"). > > > > Signed-off-by: Dmitry Vyukov <dvyukov@google.com> > > Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> > > Cc: Dave Airlie <airlied@gmail.com> > > Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> > > Cc: dri-devel@lists.freedesktop.org > > Cc: syzkaller@googlegroups.com > > Ping, this is still not merged. > David, please take this to dri tree. It's applied to drm-misc already. -Daniel > > > > --- > > > > Changes since v1: > > - removed another kfree(kbuf) > > > > I've sent a patch that adds __GFP_NOWARN to the kmalloc a while ago: > > https://groups.google.com/forum/#!msg/syzkaller/navdAwe4iCo/mZDhODsnAAAJ > > > > Ville suggested to allocate the buffer on stack as it must be small: > > > > "From the looks of things the longest command could be the > > "target PCI:domain:bus:dev.fn" thing. Even assuming something silly like > > having 10 characters for each domain,bus,dev,fn that would still be only > > 55 bytes. So based on that even something like 64 bytes should be more > > than enough AFAICS. " > > > > Example WARNING: > > > > WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999 > > __alloc_pages_nodemask+0x7d2/0x1760() > > Modules linked in: > > CPU: 2 PID: 29322 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #283 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > 00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000 > > ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9 > > ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0 > > Call Trace: > > [< inline >] __dump_stack lib/dump_stack.c:15 > > [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 > > [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 > > [<ffffffff8134ff29>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 > > [< inline >] __alloc_pages_slowpath mm/page_alloc.c:2999 > > [<ffffffff8166de32>] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253 > > [<ffffffff81745c99>] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090 > > [< inline >] alloc_pages include/linux/gfp.h:459 > > [<ffffffff81669bb6>] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433 > > [<ffffffff816c20af>] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008 > > [<ffffffff816c212f>] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019 > > [< inline >] kmalloc_large include/linux/slab.h:395 > > [<ffffffff81756b24>] __kmalloc+0x2f4/0x340 mm/slub.c:3557 > > [< inline >] kmalloc include/linux/slab.h:468 > > [<ffffffff832c65a4>] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926 > > [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719 > > [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849 > > [<ffffffff817ad8b6>] vfs_writev+0x86/0xc0 fs/read_write.c:886 > > [< inline >] SYSC_writev fs/read_write.c:919 > > [<ffffffff817b0a21>] SyS_writev+0x111/0x2b0 fs/read_write.c:911 > > [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a > > arch/x86/entry/entry_64.S:185 > > --- > > drivers/gpu/vga/vgaarb.c | 15 ++++----------- > > 1 file changed, 4 insertions(+), 11 deletions(-) > > > > diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c > > index 1887f19..77657a8 100644 > > --- a/drivers/gpu/vga/vgaarb.c > > +++ b/drivers/gpu/vga/vgaarb.c > > @@ -1022,21 +1022,16 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, > > > > unsigned int io_state; > > > > - char *kbuf, *curr_pos; > > + char kbuf[64], *curr_pos; > > size_t remaining = count; > > > > int ret_val; > > int i; > > > > - > > - kbuf = kmalloc(count + 1, GFP_KERNEL); > > - if (!kbuf) > > - return -ENOMEM; > > - > > - if (copy_from_user(kbuf, buf, count)) { > > - kfree(kbuf); > > + if (count >= sizeof(kbuf)) > > + return -EINVAL; > > + if (copy_from_user(kbuf, buf, count)) > > return -EFAULT; > > - } > > curr_pos = kbuf; > > kbuf[count] = '\0'; /* Just to make sure... */ > > > > @@ -1259,11 +1254,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, > > goto done; > > } > > /* If we got here, the message written is not part of the protocol! */ > > - kfree(kbuf); > > return -EPROTO; > > > > done: > > - kfree(kbuf); > > return ret_val; > > } > > > > -- > > 2.8.0.rc3.226.g39d4020 > > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index 1887f19..77657a8 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1022,21 +1022,16 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, unsigned int io_state; - char *kbuf, *curr_pos; + char kbuf[64], *curr_pos; size_t remaining = count; int ret_val; int i; - - kbuf = kmalloc(count + 1, GFP_KERNEL); - if (!kbuf) - return -ENOMEM; - - if (copy_from_user(kbuf, buf, count)) { - kfree(kbuf); + if (count >= sizeof(kbuf)) + return -EINVAL; + if (copy_from_user(kbuf, buf, count)) return -EFAULT; - } curr_pos = kbuf; kbuf[count] = '\0'; /* Just to make sure... */ @@ -1259,11 +1254,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } /* If we got here, the message written is not part of the protocol! */ - kfree(kbuf); return -EPROTO; done: - kfree(kbuf); return ret_val; }