linux-kernel - Re: [PATCH 8/9] Add explicit bound checks in mm/migrate.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu,  1 Oct 2009 14:54:59 +0900 (JST)
From:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	kosaki.motohiro@...fujitsu.com,
	Arjan van de Ven <arjan@...radead.org>,
	linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
	mingo@...e.hu, Christoph Lameter <cl@...ux-foundation.org>
Subject: Re: [PATCH 8/9] Add explicit bound checks in mm/migrate.c

Hi

> On Sat, 26 Sep 2009 20:54:06 +0200
> Arjan van de Ven <arjan@...radead.org> wrote:
> 
> > From: Arjan van de Ven <arjan@...ux.intel.com>
> > Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
> > CC: akpm@...ux-foundation.org
> > 
> > The memory migration code has some curious copy_from_user bounds,
> > that are likely ok, but are not immediately obvious to me or to GCC.
> > 
> > This patch adds a simple explicit bound check; this allows GCC
> > and me to be more assured that the copy_from_user will never overwrite
> > its destination buffer.
> 
> I don't really see what's being fixed here.  The original code seems
> straightforward and safe enough?

I think original code is safe too.

> The identifier `chunk_nr' is a bit ambiguous.  Is it "number of chunks" or
> is it "index of this chunk"?

chunk_nr is batch size. (ie it's number of chunks)


Plus, I have a review comment.

> 
> > 
> > diff --git a/mm/migrate.c b/mm/migrate.c
> > index 1a4bf48..5b9ebc5 100644
> > --- a/mm/migrate.c
> > +++ b/mm/migrate.c
> > @@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
> >  	int err;
> >  
> >  	for (i = 0; i < nr_pages; i += chunk_nr) {
> > +		unsigned int copy;
> >  		if (chunk_nr + i > nr_pages)
> >  			chunk_nr = nr_pages - i;
> 
> A newline after end-of-locals is conventional.
> 
> `i' and `chunk_nr' have type `unsigned long' and you're mixing that up
> with `unsigned int'.
> 
> > -		err = copy_from_user(chunk_pages, &pages[i],
> > -				     chunk_nr * sizeof(*chunk_pages));
> 
> And we mix it up with size_t as well.
> 
> The type choices are a bit confused and sloppy.  Converting it all to
> `unsigned int' should be OK.
> 
> > +		copy = chunk_nr * sizeof(*chunk_pages);
> > +		if (copy > DO_PAGES_STAT_CHUNK_NR)
> > +			return -EFAULT;

this seems a bit strange. 
the unit of copy is byte. but the unit of DO_PAGES_STAT_CHUNK_NR is
not byte.



> > +
> > +		err = copy_from_user(chunk_pages, &pages[i], copy);
> >  		if (err) {
> >  			err = -EFAULT;
> >  			goto out;
> 
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/