linux-kernel - Re: [PATCH] Using a pointer and kzalloc in place of a struct directly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200912114706.GA171774@kroah.com>
Date:   Sat, 12 Sep 2020 13:47:06 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Anant Thazhemadam <anant.thazhemadam@...il.com>
Cc:     andriin@...com, ast@...nel.org, bpf@...r.kernel.org,
        daniel@...earbox.net, davem@...emloft.net, hawk@...nel.org,
        john.fastabend@...il.com, kafai@...com, kpsingh@...omium.org,
        kuba@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Using a pointer and kzalloc in place of a struct directly

On Sat, Sep 12, 2020 at 05:08:04PM +0530, Anant Thazhemadam wrote:
> Updated the usage of a struct variable directly, in bpf_link_get_info_by_fd
> to using a pointer of the same type instead, which points to a memory 
> location allocated using kzalloc.
> 
> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@...il.com>

Note, your "To:" line seemed corrupted, and why not cc: the bpf mailing
list as well?

Anyway, comment on your patch below:

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 4108ef3b828b..01b9c203ef65 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3605,30 +3605,31 @@ static int bpf_link_get_info_by_fd(struct file *file,
>  				  union bpf_attr __user *uattr)
>  {
>  	struct bpf_link_info __user *uinfo = u64_to_user_ptr(attr->info.info);
> -	struct bpf_link_info info;
> +	struct bpf_link_info *info = NULL;
>  	u32 info_len = attr->info.info_len;
>  	int err;
>  
> -	err = bpf_check_uarg_tail_zero(uinfo, sizeof(info), info_len);
> +	err = bpf_check_uarg_tail_zero(uinfo, sizeof(struct bpf_link_info), info_len);
> +
>  	if (err)
>  		return err;
>  	info_len = min_t(u32, sizeof(info), info_len);
>  
> -	memset(&info, 0, sizeof(info));
> -	if (copy_from_user(&info, uinfo, info_len))
> +	info = kzalloc(sizeof(struct bpf_link_info), GFP_KERNEL);
> +	if (copy_from_user(info, uinfo, info_len))
>  		return -EFAULT;

You leaked memory :(

Did you test this patch?  Where do you free this memory, I don't see
that happening anywhere in this patch, did I miss it?

And odds are this change will slow things down, right?  Why make this
change, what's wrong with the structure being on the stack?

thanks,

greg k-h