On 01/12/2017 06:37 PM, Michal Hocko wrote: > On Thu 12-01-17 09:26:09, Kees Cook wrote: >> On Thu, Jan 12, 2017 at 7:37 AM, Michal Hocko <mhocko@xxxxxxxxxx> wrote: > [...] >>> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c >>> index 4f74511015b8..e6bbb33d2956 100644 >>> --- a/arch/s390/kvm/kvm-s390.c >>> +++ b/arch/s390/kvm/kvm-s390.c >>> @@ -1126,10 +1126,7 @@ static long kvm_s390_get_skeys(struct kvm *kvm, struct kvm_s390_skeys *args) >>> if (args->count < 1 || args->count > KVM_S390_SKEYS_MAX) >>> return -EINVAL; >>> >>> - keys = kmalloc_array(args->count, sizeof(uint8_t), >>> - GFP_KERNEL | __GFP_NOWARN); >>> - if (!keys) >>> - keys = vmalloc(sizeof(uint8_t) * args->count); >>> + keys = kvmalloc(args->count * sizeof(uint8_t), GFP_KERNEL); >> >> Before doing this conversion, can we add a kvmalloc_array() API? This >> conversion could allow for the reintroduction of integer overflow >> flaws. (This particular situation isn't at risk since ->count is >> checked, but I'd prefer we not create a risky set of examples for >> using kvmalloc.) > > Well, I am not opposed to kvmalloc_array but I would argue that this > conversion cannot introduce new overflow issues. The code would have > to be broken already because even though kmalloc_array checks for the > overflow but vmalloc fallback doesn't... Yeah I agree, but if some of the places were really wrong, after the conversion we won't see them anymore. > If there is a general interest for this API I can add it. I think it would be better, yes. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
