| Message ID | 20221126050745.778967-1-harshit.m.mogalapalli@oracle.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 8b997b2bb2c53b76a6db6c195930e9ab8e4b0c79 |
| Headers | show |
| Series | xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() | expand |
On 26.11.22 06:07, Harshit Mogalapalli wrote: > As 'kdata.num' is user-controlled data, if user tries to allocate > memory larger than(>=) MAX_ORDER, then kcalloc() will fail, it > creates a stack trace and messes up dmesg with a warning. > > Call trace: > -> privcmd_ioctl > --> privcmd_ioctl_mmap_resource > > Add __GFP_NOWARN in order to avoid too large allocation warning. > This is detected by static analysis using smatch. > > Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Juergen Gross <jgross@suse.com> Juergen
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index fae50a24630b..1edf45ee9890 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -760,7 +760,7 @@ static long privcmd_ioctl_mmap_resource(struct file *file, goto out; } - pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL); + pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL | __GFP_NOWARN); if (!pfns) { rc = -ENOMEM; goto out;
As 'kdata.num' is user-controlled data, if user tries to allocate memory larger than(>=) MAX_ORDER, then kcalloc() will fail, it creates a stack trace and messes up dmesg with a warning. Call trace: -> privcmd_ioctl --> privcmd_ioctl_mmap_resource Add __GFP_NOWARN in order to avoid too large allocation warning. This is detected by static analysis using smatch. Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> --- drivers/xen/privcmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)