linux-kernel - Re: dm: ioctl: use kvfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87wpo3q5xp.fsf@rasmusvillemoes.dk>
Date:	Mon, 11 Apr 2016 21:52:18 +0200
From:	Rasmus Villemoes <linux@...musvillemoes.dk>
To:	Sudip Mukherjee <sudipm.mukherjee@...il.com>
Cc:	Mike Snitzer <snitzer@...hat.com>,
	Alasdair Kergon <agk@...hat.com>, Shaohua Li <shli@...nel.org>,
	linux-kernel@...r.kernel.org, dm-devel@...hat.com,
	linux-raid@...r.kernel.org
Subject: Re: dm: ioctl: use kvfree

On Mon, Apr 11 2016, Sudip Mukherjee <sudipm.mukherjee@...il.com> wrote:

> On Monday 11 April 2016 08:47 PM, Mike Snitzer wrote:
>> On Mon, Apr 11 2016 at 11:14am -0400,
>> Sudip Mukherjee <sudipm.mukherjee@...il.com> wrote:
>>
>>> We can use kvfree() instead of calling kfree() and vfree() based on
>>> if-else and param_flags. kvfree() will check the type of address and
>>> will call the respective function to free it.
>>> Additionally we can also remove the use of DM_PARAMS_KMALLOC and
>>> DM_PARAMS_VMALLOC.
>>>
>>> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@...ethink.co.uk>
>>
>> Have you actually tested htis?  Last time I looked to do this it exposed
>> crashes.  I don't have time to dig into this again right now but this is
>> _not_ as simple as this patch implies.
>>
>
> No, it was just build tested. Is it possible to test it in qemu or kvm?
>

No need to test it, just read copy_params() and its caller,
ctl_ioctl(). The latter passes a stack buffer as param_kernel, and
copy_params() does

        if (ioctl_flags & IOCTL_FLAGS_NO_PARAMS) {
                dmi = param_kernel;

with dmi later returned via *param. So it is entirely possible that
free_params ends up calling neither kfree or vfree, since there's
nothing to free.

Rasmus