On Sat, May 13, 2017 at 1:37 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>
> That's a valid point and it might apply to memdup_user() callers out there.
> Potential variants:
> * add an explicit upper bound on the size and turn that into
> memdup_user() (and check that all memdup_user() callers are bounded).
> * have memdup_user() itself pass __GFP_NOWARN.
> * add kvmemdup_user() that would use kvmalloc() (with its callers
> expected to use kvfree()); see who else might benefit from conversion.
All of the above sound reasonable.
I wouldn't change the existing "memdup_user()" interface itself, but
if there really are users that can validly pass in a maxbyte value,
why not add a new helper:
void *memdup_user_limit(userptr, nmember, nsize, maxsize);
and then have
#define memdup_user(ptr,size) memdup_user_limit(ptr, size, 1, -1)
or something. I definitely see a couple of memdup_user() people who do
that "num*size" multiplication by hand, and it's very easy to get
wrong and have an overflow.
And for a kvmalloc/kvfree() interface, you *definitely* want that
maxsize thing, since it absolutely needs an upper limit.
Linus
