linux-kernel - Re: [patch] slub crashes with recent -git

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20070723135920.01893968@schroedinger.engr.sgi.com>
Date:	Mon, 23 Jul 2007 13:59:20 -0700
From:	Christoph Lameter <clameter@....com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org
Subject: Re: [patch] slub crashes with recent -git

On Thu, 19 Jul 2007 13:25:07 -0700 (PDT)
Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> 
> 
> On Thu, 19 Jul 2007, Linus Torvalds wrote:
> > 
> > A better patch should be the appended. Does that work for you too?
> 
> Btw, I already committed this as obvious. 
> 
> I did the same for the SLAB __do_kmalloc() thing. Let's hope that
> that was the extent of the damage.
> 
> 		Linus

Hmmmm.. The issue is really in krealloc which can be called with a NULL
parameter (a special case). However, krealloc should not call ksize
with NULL.

The merged patch above makes ksize(NULL) return 0. So we are
returning zero size for an object that we have not allocated.
Better fail if someone tries that.

The __do_kmalloc issue looks like a hunk that was somehow dropped.

IMHO: The right fix for the ksize issue would be the following patch:


Index: linux-2.6/mm/util.c
===================================================================
--- linux-2.6.orig/mm/util.c	2007-07-23 13:29:42.000000000 -0700
+++ linux-2.6/mm/util.c	2007-07-23 13:31:28.000000000 -0700
@@ -88,7 +88,11 @@ void *krealloc(const void *p, size_t new
 		return ZERO_SIZE_PTR;
 	}
 
-	ks = ksize(p);
+	if (p)
+		ks = ksize(p);
+	else
+		ks = 0;
+
 	if (ks >= new_size)
 		return (void *)p;
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/