On Fri, Oct 14, 2016 at 3:06 PM, Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> wrote: > On Fri, Oct 14, 2016 at 02:54:59PM +0200, Dmitry Vyukov wrote: >> Size of kmalloc() in vga_arb_write() is controlled by user. >> Too large kmalloc() size triggers WARNING message on console. >> Allocate the buffer on stack to avoid the WARNING. >> The string must be small (e.g "target PCI:domain:bus:dev.fn"). >> >> Signed-off-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> >> Cc: Dave Airlie <airlied@xxxxxxxxx> >> Cc: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> >> Cc: dri-devel@xxxxxxxxxxxxxxxxxxxxx >> Cc: syzkaller@xxxxxxxxxxxxxxxx >> >> -- >> >> I've sent a patch that adds __GFP_NOWARN to the kmalloc a while ago: >> https://groups.google.com/forum/#!msg/syzkaller/navdAwe4iCo/mZDhODsnAAAJ >> >> Ville suggested to allocate the buffer on stack as it must be small: >> >> "From the looks of things the longest command could be the >> "target PCI:domain:bus:dev.fn" thing. Even assuming something silly like >> having 10 characters for each domain,bus,dev,fn that would still be only >> 55 bytes. So based on that even something like 64 bytes should be more >> than enough AFAICS. " > >> >> Example WARNING: >> >> WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999 >> __alloc_pages_nodemask+0x7d2/0x1760() >> Modules linked in: >> CPU: 2 PID: 29322 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #283 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> 00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000 >> ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9 >> ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0 >> Call Trace: >> [< inline >] __dump_stack lib/dump_stack.c:15 >> [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 >> [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 >> [<ffffffff8134ff29>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 >> [< inline >] __alloc_pages_slowpath mm/page_alloc.c:2999 >> [<ffffffff8166de32>] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253 >> [<ffffffff81745c99>] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090 >> [< inline >] alloc_pages include/linux/gfp.h:459 >> [<ffffffff81669bb6>] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433 >> [<ffffffff816c20af>] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008 >> [<ffffffff816c212f>] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019 >> [< inline >] kmalloc_large include/linux/slab.h:395 >> [<ffffffff81756b24>] __kmalloc+0x2f4/0x340 mm/slub.c:3557 >> [< inline >] kmalloc include/linux/slab.h:468 >> [<ffffffff832c65a4>] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926 >> [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719 >> [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849 >> [<ffffffff817ad8b6>] vfs_writev+0x86/0xc0 fs/read_write.c:886 >> [< inline >] SYSC_writev fs/read_write.c:919 >> [<ffffffff817b0a21>] SyS_writev+0x111/0x2b0 fs/read_write.c:911 >> [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a >> arch/x86/entry/entry_64.S:185 >> --- >> drivers/gpu/vga/vgaarb.c | 11 +++-------- >> 1 file changed, 3 insertions(+), 8 deletions(-) >> >> diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c >> index 1887f19..0c73083 100644 >> --- a/drivers/gpu/vga/vgaarb.c >> +++ b/drivers/gpu/vga/vgaarb.c >> @@ -1022,17 +1022,14 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, >> >> unsigned int io_state; >> >> - char *kbuf, *curr_pos; >> + char kbuf[64], *curr_pos; >> size_t remaining = count; >> >> int ret_val; >> int i; >> >> - >> - kbuf = kmalloc(count + 1, GFP_KERNEL); >> - if (!kbuf) >> - return -ENOMEM; >> - >> + if (count >= sizeof(kbuf)) >> + return -EINVAL; >> if (copy_from_user(kbuf, buf, count)) { >> kfree(kbuf); > > You missed one kfree() here. Ouch! > Assuming my analysis of the max string length wasn't full of crap > I think this looks fine otherwise. > > So with the lingering kfree() nuked this is > Reviewed-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> Mailed v2. Thanks! >> return -EFAULT; >> @@ -1259,11 +1256,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, >> goto done; >> } >> /* If we got here, the message written is not part of the protocol! */ >> - kfree(kbuf); >> return -EPROTO; >> >> done: >> - kfree(kbuf); >> return ret_val; >> } >> >> -- >> 2.8.0.rc3.226.g39d4020 > > -- > Ville Syrjälä > Intel OTC _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
