linux-kernel - Re: [PATCH] lib/idr.c: Zero memory properly in idr_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 14 Jan 2009 19:05:10 +0100
From:	Stefan Richter <stefanr@...6.in-berlin.de>
To:	Kristian Høgsberg <krh@...hat.com>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Manfred Spraul <manfred@...orfullife.com>, dcm@....org,
	Nadia.Derbey@...l.net, linux1394-devel@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org, paulmck@...ibm.com
Subject: Re: [PATCH] lib/idr.c: Zero memory properly in idr_remove_all

Kristian Høgsberg wrote:
> On Wed, 2009-01-14 at 17:21 +0100, Stefan Richter wrote:
>> Kristian Høgsberg wrote:
>>> On Tue, 2009-01-13 at 14:48 -0800, Andrew Morton wrote:
>>>> What do we think of just removing the constructor and using
>>>> kmem_cache_zalloc()?
>>> We still need to zero out the idr_layer before returning it to the idr's
>>> internal free list.
>> I think so too.  But a more robust solution would IMO be to initialize
>> an idr_layer /before/ use, not /after/ use.  Will send a patch later.
> 
> The reason it was done this way is that normally, when the layers are
> returned to the free list they're already zero'ed out (since their
> elements have been removed one by one), so no need to do this on later
> re-initialization or when freeing.  It's a silly little
> sup-optimization.

Ah, right.

> idr_remove_all() is different in that it doesn't
> incrementally zero out the layer, and so it has to do it using a memset.
> 
> If you want rework how this works, I'd suggest just not using the free
> list except for in the idr_pre_get()+idr_get() sequence.  When a layer
> is no longer used, just free it, don't put it back on the free list.
> And use kmem_cache_zalloc() in idr_pre_get() as Andrew suggests.

Wait a moment:  Nadia's change (which introduced the bug) also already
implements your suggestion.  idr_remove_all feeds to the kmem cache now,
not to the free list anymore.

So, Andrew, I take back my assertion that the sequence

	idr_remove_all(idr);

	if (idr_pre_get(idr, GFP_KERNEL))
		id = idr_get_new(idr, p, h);

would be unsafe.  Your fix has this covered as well.
-- 
Stefan Richter
-=====-==--= ---= -===-
http://arcgraph.de/sr/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/