Message ID | 20220923202822.2667581-7-keescook@chromium.org (mailing list archive) |
---|---|
State | Not Applicable |
Headers |
Received: from vger.kernel.org ([23.128.96.18]) by www.linuxtv.org with esmtp (Exim 4.92) (envelope-from <linux-media-owner@vger.kernel.org>) id 1obpNA-008Wme-NG; Fri, 23 Sep 2022 20:34:10 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233003AbiIWUeF (ORCPT <rfc822;mkrufky@linuxtv.org> + 1 other); Fri, 23 Sep 2022 16:34:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52416 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233042AbiIWUcd (ORCPT <rfc822;linux-media@vger.kernel.org>); Fri, 23 Sep 2022 16:32:33 -0400 Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2801145961 for <linux-media@vger.kernel.org>; Fri, 23 Sep 2022 13:28:29 -0700 (PDT) Received: by mail-pj1-x102c.google.com with SMTP id j6-20020a17090a694600b00200bba67dadso1232275pjm.5 for <linux-media@vger.kernel.org>; Fri, 23 Sep 2022 13:28:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date; bh=G7kCAYdmee+RZ/2FVUhmFmKba16DTFtB/qncTXfqL0g=; b=Y6E7L9J9UR374oBO9JTlj0UyLXz47O6O/vrwsT4xNx7MOToGuF3Haek94epLF2gKFc YHBgJXmOtfririgUsUdUJ7cJUEJhj34PvSPp7NewDy4HIxUbfstnz0HwtTKsvV+jUdM9 ewYTBmIsL92mb0z3umh2K5ZPB3wBhsrYJr07w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date; bh=G7kCAYdmee+RZ/2FVUhmFmKba16DTFtB/qncTXfqL0g=; b=Z3+ob6YOPacqm7OE0IqbWDo5OwzKiLgnsL1PMDPlJdQFKi7eqDEmC2xiVbdtuuAwFD FneQJRxZQxeQ2GGMfXSguK4JJdoXxNdcwXFjjLr1OayAXj6VXG/1wBRlCVzO8qyCsgDX oeOLKIE8pnQqecl4UpQQm4j6XD078DZFtakCwCy31463qFNMTy+hjwn8yQYM6sYuNGry X+G4G2+FjlUs/gC3gkIa+ApscL9u4lQu2ZGTtzKKmRGdB8TZEusTNurZpYp/NhTfi/UR UDXp3kRBvOzUCyuBvK5eZMO6irXeGMJJqAcupToZIhfLQ58M69j3+G6ytjNvO+1R61W3 OCKQ== X-Gm-Message-State: ACrzQf3hXqZ7agxHsROTiiqWo1axbNhbCwW15QO6axv6zNvbRF4jFmfJ PbJGr3rvy7us+58gggiDn68Brw== X-Google-Smtp-Source: AMsMyM4OIH2Kbz3W/dS5nJOpu2wzufZOda+7SbBQGOF/tLPl7Mw1AUJglcwrNduXNP5ZLvyQaDEecg== X-Received: by 2002:a17:90b:1942:b0:202:cf66:f37f with SMTP id nk2-20020a17090b194200b00202cf66f37fmr22638049pjb.15.1663964909318; Fri, 23 Sep 2022 13:28:29 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id z12-20020a6553cc000000b0041d6d37deb5sm6016364pgr.81.2022.09.23.13.28.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 23 Sep 2022 13:28:28 -0700 (PDT) From: Kees Cook <keescook@chromium.org> To: Vlastimil Babka <vbabka@suse.cz> Cc: Kees Cook <keescook@chromium.org>, Jesse Brandeburg <jesse.brandeburg@intel.com>, Tony Nguyen <anthony.l.nguyen@intel.com>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, "Ruhl, Michael J" <michael.j.ruhl@intel.com>, Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christoph Lameter <cl@linux.com>, Pekka Enberg <penberg@kernel.org>, David Rientjes <rientjes@google.com>, Joonsoo Kim <iamjoonsoo.kim@lge.com>, Andrew Morton <akpm@linux-foundation.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Nick Desaulniers <ndesaulniers@google.com>, Alex Elder <elder@kernel.org>, Josef Bacik <josef@toxicpanda.com>, David Sterba <dsterba@suse.com>, Sumit Semwal <sumit.semwal@linaro.org>, =?utf-8?q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>, Daniel Micay <danielmicay@gmail.com>, Yonghong Song <yhs@fb.com>, Marco Elver <elver@google.com>, Miguel Ojeda <ojeda@kernel.org>, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-btrfs@vger.kernel.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-fsdevel@vger.kernel.org, dev@openvswitch.org, x86@kernel.org, llvm@lists.linux.dev, linux-hardening@vger.kernel.org Subject: [PATCH v2 06/16] igb: Proactively round up to kmalloc bucket size Date: Fri, 23 Sep 2022 13:28:12 -0700 Message-Id: <20220923202822.2667581-7-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220923202822.2667581-1-keescook@chromium.org> References: <20220923202822.2667581-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1691; h=from:subject; bh=laYkgTmsp2Dcg0WHHOT6ZPL9V6mSc2dOwctf45ZQYvY=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjLhbkDJzHnX+sI3Vo1Qv14V482wiYBuOHMxTmnIBU huucnceJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYy4W5AAKCRCJcvTf3G3AJiyLEA CGMES+fC6ye1bGeS3O38IPkN3IQzERShfic80XY4a30XyimxkLkJSmvXpj+ewPNbHKoiUJTxKgZb/K XnxJDpvuDtFtz8bmbN5m2Yd+S7u9U0FJix4D0Bjc65bO2BLZ1p4skZ00ujWbdyLS1BgmyosrJ9xVP9 Jeb1iFSNfgRZVKqrPKkicjNZr+6mjZxTYoH7c+LPVPfoyyMsulrIGhvF9VSVGvkUMxknLO8TmnWGGL YXw+DzIp3KOAD7McaSE+ctkuIt/4FqAoG9rJOaNF0THgqKo9qaiN3ta16/oNWQocOWuZiKKVTKaDQl ec8EwXmI83Hw0xcmg1Pk7Nyaa5u6CNYuOr6/QPIyHM/G9zTOgaQKJDjVdTfOWZueQU0z56sMQd76h2 EgoHovJDkExXKzaR3tSExdysEeji5cAz5MTF6B5PhevY//J2SrfmsF3Umuqd3PdQ8Z+4FkekBNeaIt Wpzdj496etMeazF2E/aottRll8HUp1QXtMIraqM7WAgkIUg557ze4RTKXXeQvpWrgT6a464S9QSBKF D28gqdBRRs+c1X8XxNNTSpIWgjw0U1bUDku7eV4GRnqprMwn16uXdgttSoB7bVSJibtA6uv2jYfhpW HJE8ECmRl+W/2kM5Fz/2+NW1rofopoBc5f5LUPED2ZPHjOI5nqOO7GaJaF1w== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-media.vger.kernel.org> X-Mailing-List: linux-media@vger.kernel.org X-LSpam-Score: -2.5 (--) X-LSpam-Report: No, score=-2.5 required=5.0 tests=BAYES_00=-1.9,DKIMWL_WL_HIGH=0.001,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,HEADER_FROM_DIFFERENT_DOMAINS=0.5,MAILING_LIST_MULTI=-1 autolearn=ham autolearn_force=no |
Series |
slab: Introduce kmalloc_size_roundup()
|
|
Commit Message
Kees Cook
Sept. 23, 2022, 8:28 p.m. UTC
In preparation for removing the "silently change allocation size"
users of ksize(), explicitly round up all q_vector allocations so that
allocations can be correctly compared to ksize().
Additionally fix potential use-after-free in the case of new allocation
failure: only free memory if the replacement allocation succeeds.
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
Comments
>-----Original Message----- >From: Kees Cook <keescook@chromium.org> >Sent: Friday, September 23, 2022 4:28 PM >To: Vlastimil Babka <vbabka@suse.cz> >Cc: Kees Cook <keescook@chromium.org>; Brandeburg, Jesse ><jesse.brandeburg@intel.com>; Nguyen, Anthony L ><anthony.l.nguyen@intel.com>; David S. Miller <davem@davemloft.net>; >Eric Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; >Paolo Abeni <pabeni@redhat.com>; intel-wired-lan@lists.osuosl.org; >netdev@vger.kernel.org; Ruhl, Michael J <michael.j.ruhl@intel.com>; >Hyeonggon Yoo <42.hyeyoo@gmail.com>; Christoph Lameter ><cl@linux.com>; Pekka Enberg <penberg@kernel.org>; David Rientjes ><rientjes@google.com>; Joonsoo Kim <iamjoonsoo.kim@lge.com>; Andrew >Morton <akpm@linux-foundation.org>; Greg Kroah-Hartman ><gregkh@linuxfoundation.org>; Nick Desaulniers ><ndesaulniers@google.com>; Alex Elder <elder@kernel.org>; Josef Bacik ><josef@toxicpanda.com>; David Sterba <dsterba@suse.com>; Sumit Semwal ><sumit.semwal@linaro.org>; Christian König <christian.koenig@amd.com>; >Daniel Micay <danielmicay@gmail.com>; Yonghong Song <yhs@fb.com>; >Marco Elver <elver@google.com>; Miguel Ojeda <ojeda@kernel.org>; linux- >kernel@vger.kernel.org; linux-mm@kvack.org; linux-btrfs@vger.kernel.org; >linux-media@vger.kernel.org; dri-devel@lists.freedesktop.org; linaro-mm- >sig@lists.linaro.org; linux-fsdevel@vger.kernel.org; dev@openvswitch.org; >x86@kernel.org; llvm@lists.linux.dev; linux-hardening@vger.kernel.org >Subject: [PATCH v2 06/16] igb: Proactively round up to kmalloc bucket size > >In preparation for removing the "silently change allocation size" >users of ksize(), explicitly round up all q_vector allocations so that >allocations can be correctly compared to ksize(). > >Additionally fix potential use-after-free in the case of new allocation >failure: only free memory if the replacement allocation succeeds. > >Cc: Jesse Brandeburg <jesse.brandeburg@intel.com> >Cc: Tony Nguyen <anthony.l.nguyen@intel.com> >Cc: "David S. Miller" <davem@davemloft.net> >Cc: Eric Dumazet <edumazet@google.com> >Cc: Jakub Kicinski <kuba@kernel.org> >Cc: Paolo Abeni <pabeni@redhat.com> >Cc: intel-wired-lan@lists.osuosl.org >Cc: netdev@vger.kernel.org >Signed-off-by: Kees Cook <keescook@chromium.org> >--- > drivers/net/ethernet/intel/igb/igb_main.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > >diff --git a/drivers/net/ethernet/intel/igb/igb_main.c >b/drivers/net/ethernet/intel/igb/igb_main.c >index 2796e81d2726..eb51e531c096 100644 >--- a/drivers/net/ethernet/intel/igb/igb_main.c >+++ b/drivers/net/ethernet/intel/igb/igb_main.c >@@ -1195,15 +1195,16 @@ static int igb_alloc_q_vector(struct igb_adapter >*adapter, > return -ENOMEM; > > ring_count = txr_count + rxr_count; >- size = struct_size(q_vector, ring, ring_count); >+ size = kmalloc_size_roundup(struct_size(q_vector, ring, ring_count)); This looks good to me... > /* allocate q_vector and rings */ > q_vector = adapter->q_vector[v_idx]; > if (!q_vector) { > q_vector = kzalloc(size, GFP_KERNEL); > } else if (size > ksize(q_vector)) { >- kfree_rcu(q_vector, rcu); > q_vector = kzalloc(size, GFP_KERNEL); >+ if (q_vector) >+ kfree_rcu(q_vector, rcu); Even though this is in the ksize part, this seems like an unrelated change? Should this be in a different patch? Also, the kfree_rcu will free q_vector after the RCU grace period? Is that what you want to do? How does rcu distinguish between the original q_vector, and the newly kzalloced one? Thanks, Mike > } else { > memset(q_vector, 0, size); > } >-- >2.34.1
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 2796e81d2726..eb51e531c096 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -1195,15 +1195,16 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter, return -ENOMEM; ring_count = txr_count + rxr_count; - size = struct_size(q_vector, ring, ring_count); + size = kmalloc_size_roundup(struct_size(q_vector, ring, ring_count)); /* allocate q_vector and rings */ q_vector = adapter->q_vector[v_idx]; if (!q_vector) { q_vector = kzalloc(size, GFP_KERNEL); } else if (size > ksize(q_vector)) { - kfree_rcu(q_vector, rcu); q_vector = kzalloc(size, GFP_KERNEL); + if (q_vector) + kfree_rcu(q_vector, rcu); } else { memset(q_vector, 0, size); }