On 09/13/2018 08:26 AM, Tetsuo Handa wrote: > On 2018/09/13 12:02, Paul Moore wrote: >> On Fri, Sep 7, 2018 at 12:43 PM Tetsuo Handa >> <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: >>> syzbot is hitting warning at str_read() [1] because len parameter can >>> become larger than KMALLOC_MAX_SIZE. We don't need to emit warning for >>> this case. >>> >>> [1] https://syzkaller.appspot.com/bug?id=7f2f5aad79ea8663c296a2eedb81978401a908f0 >>> >>> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> >>> Reported-by: syzbot <syzbot+ac488b9811036cea7ea0@xxxxxxxxxxxxxxxxxxxxxxxxx> >>> --- >>> security/selinux/ss/policydb.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c >>> index e9394e7..f4eadd3 100644 >>> --- a/security/selinux/ss/policydb.c >>> +++ b/security/selinux/ss/policydb.c >>> @@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len) >>> if ((len == 0) || (len == (u32)-1)) >>> return -EINVAL; >>> >>> - str = kmalloc(len + 1, flags); >>> + str = kmalloc(len + 1, flags | __GFP_NOWARN); >>> if (!str) >>> return -ENOMEM; >> Thanks for the patch. >> >> My eyes are starting to glaze over a bit chasing down all of the >> different kmalloc() code paths trying to ensure that this always does >> the right thing based on size of the allocation and the different slab >> allocators ... are we sure that this will always return NULL when (len >> + 1) is greater than KMALLOC_MAX_SIZE for the different slab allocator >> configurations? >> > Yes, for (len + 1) cannot become 0 (which causes kmalloc() to return > ZERO_SIZE_PTR) due to (len == (u32)-1) check above. > > The only concern would be whether you want allocation failure messages. > I assumed you don't need it because we are returning -ENOMEM to the caller. > Would it not be better with char *str; if ((len == 0) || (len == (u32)-1) || (len >= KMALLOC_MAX_SIZE)) return -EINVAL; str = kmalloc(len + 1, flags); if (!str) return -ENOMEM;
