linux-kernel - Re: [PATCH] x86/platform/uv: move kmalloc() NULL check routine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 6 Sep 2019 12:53:52 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Austin Kim <austindh.kim@...il.com>, tglx@...utronix.de,
        mingo@...hat.com, bp@...en8.de, x86@...nel.org,
        dvhart@...radead.org, andy@...radead.org, hpa@...or.com,
        allison@...utok.net, armijn@...ldur.nl, kjlu@....edu,
        platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/platform/uv: move kmalloc() NULL check routine

On Fri, Sep 06, 2019 at 12:43:41PM +0200, Peter Zijlstra wrote:
> On Fri, Sep 06, 2019 at 11:32:52AM +0200, Greg KH wrote:
> > On Fri, Sep 06, 2019 at 08:29:51AM +0900, Austin Kim wrote:
> > > The result of kmalloc should have been checked ahead of below statement:
> > > 	pqp = (struct bau_pq_entry *)vp;
> > > 
> > > Move BUG_ON(!vp) before above statement.
> > > 
> > > Signed-off-by: Austin Kim <austindh.kim@...il.com>
> > > ---
> > >  arch/x86/platform/uv/tlb_uv.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
> > > index 20c389a..5f0a96bf 100644
> > > --- a/arch/x86/platform/uv/tlb_uv.c
> > > +++ b/arch/x86/platform/uv/tlb_uv.c
> > > @@ -1804,9 +1804,9 @@ static void pq_init(int node, int pnode)
> > >  
> > >  	plsize = (DEST_Q_SIZE + 1) * sizeof(struct bau_pq_entry);
> > >  	vp = kmalloc_node(plsize, GFP_KERNEL, node);
> > > -	pqp = (struct bau_pq_entry *)vp;
> > > -	BUG_ON(!pqp);
> > > +	BUG_ON(!vp);
> > 
> > Ick!  Don't crash the whole machine if you are out of memory, that's a
> > totally lazy and broken driver.  Fix this up properly please.
> 
> This is boot time init; if memory allocation fails, we're in trouble, no
> way forward no way back.
> 
> It is not uncommon to have BUG_ON() for alloc failing during boot.

Hey, how come you get to get away with this here, and in the tty layer I
had to do all sorts of foolish things just for the same "impossible"
thing because syzbot found a way to emulate such lunacy?

Just you wait until the fuzzers get ahold of this code...  :)

greg k-h