From patchwork Fri Oct 14 13:22:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dmitry Vyukov X-Patchwork-Id: 9377977 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1933B60779 for ; Sun, 16 Oct 2016 02:23:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0608E28FDB for ; Sun, 16 Oct 2016 02:23:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EBE5028FEC; Sun, 16 Oct 2016 02:23:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4D9FC28FDB for ; Sun, 16 Oct 2016 02:23:35 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9B9736E2A2; Sun, 16 Oct 2016 02:23:32 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) by gabe.freedesktop.org (Postfix) with ESMTPS id 11ACA6E033 for ; Fri, 14 Oct 2016 13:22:27 +0000 (UTC) Received: by mail-qk0-x22d.google.com with SMTP id z190so148785426qkc.2 for ; Fri, 14 Oct 2016 06:22:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bW1Y4lDorreH/Uk18FFU4tL4uLBiOSz01iYfIEkJGBU=; b=GEQcBUlyqW4gcdGJ5vNJiLcL4dB1C4x2V6fc3XqchnofYwjU/LI06/Ci9fK3QTjx7j l2TRTBp7H+isvlTz5US4MYc6MZpnRrlSvZUWSb4QgvvvE1DtkngJ/ypy6Y0RnmEah+Id l4UoeAin/ps9FS0VnTVh5/wMJhvONLjLRi+XTnU31oYJwqpUxrJvRG2yb82N8bPWqO4R OO+4ZDoto0GZapmP7UtGXRDza3fLxCh0JmtbU5cV6e82/TmT8EDaNPQfktQrsmOz9Ekc QWCf667pdhuQnuU6YzAd9Mt+cnAC8j2G/GV5EbtbYTpZBclEYQrNlvaMUc0C2ze+9yYB SNhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=bW1Y4lDorreH/Uk18FFU4tL4uLBiOSz01iYfIEkJGBU=; b=Exsnbp82Yz6hli7vwXL3X2Nep6cKMe2ud7VccbW4Msi3hadjRjZas3m1m8HidbQH0k zlFYLm0qm69I+7KnafMlHFs9uwXZ5zC1ebT6UwqTTUDP+9E2hP9/NEFQrb7dI67JGnrw KXL2dU8HcNDQT0HdO38Pj0FANplRzYcAcqua0UbFoIqDNfKByqX4+SH3dNC2+Tn0l89/ Fdc2MBDewyoIh1KXFsOByYPIinKz+h1zpAzx7NgB6OiT9BRv6hVqE0hWb/W9MfEHZ0Ol 1MztN5d0xdILvpr0L/6oGXnLGsAtyt9WyBi8gYt2noSJX4Mb97vcKypW2rJmV5YLXkVY RsZQ== X-Gm-Message-State: AA6/9Rk+lP76Ez8wzWViFoBgA5ogw/iuu4vR5z8GikBhRe/lIyyteoknCcLNoyLbtOvIL9pG X-Received: by 10.194.68.106 with SMTP id v10mr2027291wjt.149.1476451345887; Fri, 14 Oct 2016 06:22:25 -0700 (PDT) Received: from dvyukov-z840.muc.corp.google.com ([2a00:79e0:15:10:2035:7246:f0f7:cb12]) by smtp.gmail.com with ESMTPSA id a7sm28798997wjj.22.2016.10.14.06.22.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Oct 2016 06:22:24 -0700 (PDT) Received: by dvyukov-z840.muc.corp.google.com (Postfix, from userid 129372) id 30C1EE1281; Fri, 14 Oct 2016 15:22:24 +0200 (CEST) From: Dmitry Vyukov To: airlied@gmail.com, ville.syrjala@linux.intel.com Subject: [PATCH v2] drivers/gpu/vga: allocate vga_arb_write() buffer on stack Date: Fri, 14 Oct 2016 15:22:22 +0200 Message-Id: <1476451342-146510-1-git-send-email-dvyukov@google.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 MIME-Version: 1.0 X-Mailman-Approved-At: Sun, 16 Oct 2016 02:23:31 +0000 Cc: syzkaller@googlegroups.com, dri-devel@lists.freedesktop.org, Dmitry Vyukov X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Size of kmalloc() in vga_arb_write() is controlled by user. Too large kmalloc() size triggers WARNING message on console. Allocate the buffer on stack to avoid the WARNING. The string must be small (e.g "target PCI:domain:bus:dev.fn"). Signed-off-by: Dmitry Vyukov Reviewed-by: Ville Syrjälä Cc: Dave Airlie Cc: Ville Syrjälä Cc: dri-devel@lists.freedesktop.org Cc: syzkaller@googlegroups.com --- Changes since v1: - removed another kfree(kbuf) I've sent a patch that adds __GFP_NOWARN to the kmalloc a while ago: https://groups.google.com/forum/#!msg/syzkaller/navdAwe4iCo/mZDhODsnAAAJ Ville suggested to allocate the buffer on stack as it must be small: "From the looks of things the longest command could be the "target PCI:domain:bus:dev.fn" thing. Even assuming something silly like having 10 characters for each domain,bus,dev,fn that would still be only 55 bytes. So based on that even something like 64 bytes should be more than enough AFAICS. " Example WARNING: WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999 __alloc_pages_nodemask+0x7d2/0x1760() Modules linked in: CPU: 2 PID: 29322 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #283 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000 ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9 ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 [< inline >] __alloc_pages_slowpath mm/page_alloc.c:2999 [] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253 [] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090 [< inline >] alloc_pages include/linux/gfp.h:459 [] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433 [] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008 [] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019 [< inline >] kmalloc_large include/linux/slab.h:395 [] __kmalloc+0x2f4/0x340 mm/slub.c:3557 [< inline >] kmalloc include/linux/slab.h:468 [] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926 [] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719 [] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849 [] vfs_writev+0x86/0xc0 fs/read_write.c:886 [< inline >] SYSC_writev fs/read_write.c:919 [] SyS_writev+0x111/0x2b0 fs/read_write.c:911 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 --- drivers/gpu/vga/vgaarb.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index 1887f19..77657a8 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1022,21 +1022,16 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, unsigned int io_state; - char *kbuf, *curr_pos; + char kbuf[64], *curr_pos; size_t remaining = count; int ret_val; int i; - - kbuf = kmalloc(count + 1, GFP_KERNEL); - if (!kbuf) - return -ENOMEM; - - if (copy_from_user(kbuf, buf, count)) { - kfree(kbuf); + if (count >= sizeof(kbuf)) + return -EINVAL; + if (copy_from_user(kbuf, buf, count)) return -EFAULT; - } curr_pos = kbuf; kbuf[count] = '\0'; /* Just to make sure... */ @@ -1259,11 +1254,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } /* If we got here, the message written is not part of the protocol! */ - kfree(kbuf); return -EPROTO; done: - kfree(kbuf); return ret_val; }