[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20211201220611.656ec911478bbf0f342ea7f1@kernel.org>
Date: Wed, 1 Dec 2021 22:06:11 +0900
From: Masami Hiramatsu <mhiramat@...nel.org>
To: zhangyue <zhangyue1@...inos.cn>
Cc: naveen.n.rao@...ux.ibm.com, anil.s.keshavamurthy@...el.com,
davem@...emloft.net, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kprobes: fix out-of-bounds in register_kretprobe
On Wed, 1 Dec 2021 13:48:55 +0800
zhangyue <zhangyue1@...inos.cn> wrote:
> When the data 'rp->data_size' is negative, the code
> 'sizeof(struct kretprobe_instance)+rp->data_size'
> is less than 'sizeof(struct kretprobe_instance)'
Hmm, rp->data_size is size_t, which is unsigned value.
Of course we still need some kind of maximum limitation
because if we pass enough bigger size, the
sizeof(struct kretprobe_instance) + rp->data_size
can be negative or smaller than sizeof(struct kretprobe_instance).
Thank you,
>
> At this time, the pointer 'inst' may be out of
> bound when it is in use.
>
> Signed-off-by: zhangyue <zhangyue1@...inos.cn>
> ---
> kernel/kprobes.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index 1cf8bca1ea86..71cf6bde299f 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1983,7 +1983,7 @@ int kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long o
> int register_kretprobe(struct kretprobe *rp)
> {
> int ret;
> - struct kretprobe_instance *inst;
> + struct kretprobe_instance *inst = NULL;
> int i;
> void *addr;
>
> @@ -2024,7 +2024,8 @@ int register_kretprobe(struct kretprobe *rp)
>
> rp->rph->rp = rp;
> for (i = 0; i < rp->maxactive; i++) {
> - inst = kzalloc(sizeof(struct kretprobe_instance) +
> + if (rp->data_size >= 0)
> + inst = kzalloc(sizeof(struct kretprobe_instance) +
> rp->data_size, GFP_KERNEL);
> if (inst == NULL) {
> refcount_set(&rp->rph->ref, i);
> --
> 2.30.0
>
--
Masami Hiramatsu <mhiramat@...nel.org>
Powered by blists - more mailing lists