linux-kernel - Re: [PATCH] tty: use __GFP_NOWARN for user-controlled kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Feb 2016 14:11:37 -0800 (PST)
From:	David Rientjes <rientjes@...gle.com>
To:	Dmitry Vyukov <dvyukov@...gle.com>
cc:	gregkh@...uxfoundation.org, jslaby@...e.com,
	peter@...leysoftware.com, gnomes@...rguk.ukuu.org.uk,
	linux-kernel@...r.kernel.org, syzkaller@...glegroups.com,
	kcc@...gle.com, glider@...gle.com
Subject: Re: [PATCH] tty: use __GFP_NOWARN for user-controlled kmalloc

On Thu, 4 Feb 2016, Dmitry Vyukov wrote:

> Size of kmalloc() in vc_do_resize() is controlled by user.
> Too large kmalloc() size triggers WARNING message on console.
> 
> Use __GFP_NOWARN for this kmalloc() to not scare admins.
> 

Hmm, this is hitting the WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)) for 
order >= MAX_ORDER.

vc_do_resize() has

	if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
		return -EINVAL;

so the appropriate fix would seem to be to reject sizes that would exceed 
the page allocator's ability to return contiguous memory (MAX_ORDER) 
rather than ever trying the allocation in the first place.