On Thu, Sep 13, 2018 at 8:55 AM peter enderborg <peter.enderborg@xxxxxxxx> wrote: > On 09/13/2018 01:11 PM, Michal Hocko wrote: > > On Thu 13-09-18 09:12:04, peter enderborg wrote: > >> On 09/13/2018 08:26 AM, Tetsuo Handa wrote: > >>> On 2018/09/13 12:02, Paul Moore wrote: > >>>> On Fri, Sep 7, 2018 at 12:43 PM Tetsuo Handa > >>>> <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: > >>>>> syzbot is hitting warning at str_read() [1] because len parameter can > >>>>> become larger than KMALLOC_MAX_SIZE. We don't need to emit warning for > >>>>> this case. > >>>>> > >>>>> [1] https://syzkaller.appspot.com/bug?id=7f2f5aad79ea8663c296a2eedb81978401a908f0 > >>>>> > >>>>> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > >>>>> Reported-by: syzbot <syzbot+ac488b9811036cea7ea0@xxxxxxxxxxxxxxxxxxxxxxxxx> > >>>>> --- > >>>>> security/selinux/ss/policydb.c | 2 +- > >>>>> 1 file changed, 1 insertion(+), 1 deletion(-) > >>>>> > >>>>> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c > >>>>> index e9394e7..f4eadd3 100644 > >>>>> --- a/security/selinux/ss/policydb.c > >>>>> +++ b/security/selinux/ss/policydb.c > >>>>> @@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len) > >>>>> if ((len == 0) || (len == (u32)-1)) > >>>>> return -EINVAL; > >>>>> > >>>>> - str = kmalloc(len + 1, flags); > >>>>> + str = kmalloc(len + 1, flags | __GFP_NOWARN); > >>>>> if (!str) > >>>>> return -ENOMEM; > >>>> Thanks for the patch. > >>>> > >>>> My eyes are starting to glaze over a bit chasing down all of the > >>>> different kmalloc() code paths trying to ensure that this always does > >>>> the right thing based on size of the allocation and the different slab > >>>> allocators ... are we sure that this will always return NULL when (len > >>>> + 1) is greater than KMALLOC_MAX_SIZE for the different slab allocator > >>>> configurations? > >>>> > >>> Yes, for (len + 1) cannot become 0 (which causes kmalloc() to return > >>> ZERO_SIZE_PTR) due to (len == (u32)-1) check above. > >>> > >>> The only concern would be whether you want allocation failure messages. > >>> I assumed you don't need it because we are returning -ENOMEM to the caller. > >>> > >> Would it not be better with > >> > >> char *str; > >> > >> if ((len == 0) || (len == (u32)-1) || (len >= KMALLOC_MAX_SIZE)) > >> return -EINVAL; > >> > >> str = kmalloc(len + 1, flags); > >> if (!str) > >> return -ENOMEM; > > I strongly suspect that you want kvmalloc rather than kmalloc here. The > > larger the request the more likely is the allocation to fail. > > > > I am not familiar with the code but I assume this is a root only > > interface so we don't have to worry about nasty users scenario. > > > I don't think we get any big data there at all. Usually less than 32 bytes. However this data can be in fast path so a vmalloc is not an option. > > And some of the calls are GFP_ATOMC. Based on all the comments it looks like Tetsuo's original patch is probably the best fix right now. I'm going to merge this into selinux/next. Tetsuo, thanks for the patch, and thanks to everyone else for the comments/review. -- paul moore www.paul-moore.com
