linux-kernel - Re: [PATCH] selinux: Add __GFP_NOWARN to allocation at str

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ec6547f4-6240-d901-b2d2-b5103a10493f@sony.com>
Date:   Thu, 13 Sep 2018 14:55:11 +0200
From:   peter enderborg <peter.enderborg@...y.com>
To:     Michal Hocko <mhocko@...nel.org>
CC:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Paul Moore <paul@...l-moore.com>, <selinux@...ho.nsa.gov>,
        <syzbot+ac488b9811036cea7ea0@...kaller.appspotmail.com>,
        Eric Paris <eparis@...isplace.org>,
        <linux-kernel@...r.kernel.org>,
        Stephen Smalley <sds@...ho.nsa.gov>,
        <syzkaller-bugs@...glegroups.com>, linux-mm <linux-mm@...ck.org>
Subject: Re: [PATCH] selinux: Add __GFP_NOWARN to allocation at str_read()

On 09/13/2018 01:11 PM, Michal Hocko wrote:
> On Thu 13-09-18 09:12:04, peter enderborg wrote:
>> On 09/13/2018 08:26 AM, Tetsuo Handa wrote:
>>> On 2018/09/13 12:02, Paul Moore wrote:
>>>> On Fri, Sep 7, 2018 at 12:43 PM Tetsuo Handa
>>>> <penguin-kernel@...ove.sakura.ne.jp> wrote:
>>>>> syzbot is hitting warning at str_read() [1] because len parameter can
>>>>> become larger than KMALLOC_MAX_SIZE. We don't need to emit warning for
>>>>> this case.
>>>>>
>>>>> [1] https://syzkaller.appspot.com/bug?id=7f2f5aad79ea8663c296a2eedb81978401a908f0
>>>>>
>>>>> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>>>>> Reported-by: syzbot <syzbot+ac488b9811036cea7ea0@...kaller.appspotmail.com>
>>>>> ---
>>>>>  security/selinux/ss/policydb.c | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
>>>>> index e9394e7..f4eadd3 100644
>>>>> --- a/security/selinux/ss/policydb.c
>>>>> +++ b/security/selinux/ss/policydb.c
>>>>> @@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
>>>>>         if ((len == 0) || (len == (u32)-1))
>>>>>                 return -EINVAL;
>>>>>
>>>>> -       str = kmalloc(len + 1, flags);
>>>>> +       str = kmalloc(len + 1, flags | __GFP_NOWARN);
>>>>>         if (!str)
>>>>>                 return -ENOMEM;
>>>> Thanks for the patch.
>>>>
>>>> My eyes are starting to glaze over a bit chasing down all of the
>>>> different kmalloc() code paths trying to ensure that this always does
>>>> the right thing based on size of the allocation and the different slab
>>>> allocators ... are we sure that this will always return NULL when (len
>>>> + 1) is greater than KMALLOC_MAX_SIZE for the different slab allocator
>>>> configurations?
>>>>
>>> Yes, for (len + 1) cannot become 0 (which causes kmalloc() to return
>>> ZERO_SIZE_PTR) due to (len == (u32)-1) check above.
>>>
>>> The only concern would be whether you want allocation failure messages.
>>> I assumed you don't need it because we are returning -ENOMEM to the caller.
>>>
>> Would it not be better with
>>
>>     char *str;
>>
>>     if ((len == 0) || (len == (u32)-1) || (len >= KMALLOC_MAX_SIZE))
>>         return -EINVAL;
>>
>>     str = kmalloc(len + 1, flags);
>>     if (!str)
>>         return -ENOMEM;
> I strongly suspect that you want kvmalloc rather than kmalloc here. The
> larger the request the more likely is the allocation to fail.
>
> I am not familiar with the code but I assume this is a root only
> interface so we don't have to worry about nasty users scenario.
>
I don't think we get any big data there at all. Usually less than 32 bytes. However this data can be in fast path so a vmalloc is not an option.

And some of the calls are GFP_ATOMC.