linux-kernel - Re: slab: krealloc with GFP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 10 Sep 2013 16:51:01 -0700
From:	Joe Perches <joe@...ches.com>
To:	Christoph Lameter <cl@...ux-foundation.org>
Cc:	Pekka Enberg <penberg@...nel.org>, Matt Mackall <mpm@...enic.com>,
	linux-mm <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: slab: krealloc with GFP_ZERO defect

ping?

On Thu, 2013-08-29 at 14:47 -0700, Joe Perches wrote:
> This sequence can return non-zeroed memory from the
> padding area of the original allocation.
> 
> 	ptr = kzalloc(foo, GFP_KERNEL);
> 	if (!ptr)
> 		...
> 	new_ptr = krealloc(ptr, foo + bar, GFP_KERNEL | __GFP_ZERO);
> 
> If the realloc size is within the first actual allocation
> then the additional memory is not zeroed.
> 
> If the realloc size is not within the original allocation
> size, any non-zeroed padding from the original allocation
> is overwriting newly allocated zeroed memory.
> 
> Maybe someone more familiar with the alignment & padding can
> add the proper memset(,0,) for the __GFP_ZERO cases and also
> optimize kmalloc_track_caller to not use __GFP_ZERO, memcpy
> the current (non padded) size and zero the newly returned
> remainder if necessary.
> 
> from: mm/util.c
> ---------------------------
> static __always_inline void *__do_krealloc(const void *p, size_t new_size,
> 					   gfp_t flags)
> {
> 	void *ret;
> 	size_t ks = 0;
> 
> 	if (p)
> 		ks = ksize(p);
> 
> 	if (ks >= new_size)
> 		return (void *)p;
> 
> 	ret = kmalloc_track_caller(new_size, flags);
> 	if (ret && p)
> 		memcpy(ret, p, ks);
> 
> 	return ret;
> }
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/