linux-kernel - Re: [PATCH] slub: Potential stack overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Mar 2010 22:03:11 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Christoph Lameter <cl@...ux-foundation.org>
Cc:	Pekka J Enberg <penberg@...helsinki.fi>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] slub: Potential stack overflow

Le mercredi 24 mars 2010 à 14:49 -0500, Christoph Lameter a écrit :
> On Wed, 24 Mar 2010, Eric Dumazet wrote:
> 
> > Are we allowed to nest in these two functions ?
> 
> This is kmem_cache_close() no danger of nesting.
> 
> > These are debugging functions, what happens if kmalloc() returns NULL ?
> 
> Then you return ENOMEM and the user gets an error. We already do that in
> validate_slab_cache().
> 
> Hmmm... In this case we called from list_slab_objects() which gets called
> from free_partial() (which took a spinlock!) which gets called from
> kmem_cache_close().
> 
> Its just a debugging aid so no problem if it fails. GFP_ATOMIC?

OK, here is second version of the patch, thanks !


[PATCH] slub: Potential stack overflow

I discovered that we can overflow stack if CONFIG_SLUB_DEBUG=y and use
slabs with many objects, since list_slab_objects() and process_slab()
use DECLARE_BITMAP(map, page->objects);

With 65535 bits, we use 8192 bytes of stack ...

A possible solution is to allocate memory, using GFP_ATOMIC, and do
nothing if allocation fails.

Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
---
diff --git a/mm/slub.c b/mm/slub.c
index b364844..5ee857a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2426,9 +2426,11 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 #ifdef CONFIG_SLUB_DEBUG
 	void *addr = page_address(page);
 	void *p;
-	DECLARE_BITMAP(map, page->objects);
+	long *map = kzalloc(BITS_TO_LONGS(page->objects) * sizeof(long),
+			    GFP_ATOMIC);
 
-	bitmap_zero(map, page->objects);
+	if (!map)
+		return;
 	slab_err(s, page, "%s", text);
 	slab_lock(page);
 	for_each_free_object(p, s, page->freelist)
@@ -2443,6 +2445,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 		}
 	}
 	slab_unlock(page);
+	kfree(map);
 #endif
 }
 
@@ -3651,16 +3654,19 @@ static void process_slab(struct loc_track *t, struct kmem_cache *s,
 		struct page *page, enum track_item alloc)
 {
 	void *addr = page_address(page);
-	DECLARE_BITMAP(map, page->objects);
+	long *map = kzalloc(BITS_TO_LONGS(page->objects) * sizeof(long),
+			    GFP_ATOMIC);
 	void *p;
 
-	bitmap_zero(map, page->objects);
+	if (!map)
+		return;
 	for_each_free_object(p, s, page->freelist)
 		set_bit(slab_index(p, s, addr), map);
 
 	for_each_object(p, s, addr, page->objects)
 		if (!test_bit(slab_index(p, s, addr), map))
 			add_location(t, s, get_track(s, p, alloc));
+	kfree(map);
 }
 
 static int list_locations(struct kmem_cache *s, char *buf,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/