[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <896979d6-7365-e75-52fe-ad929e3e8620@inria.fr>
Date: Tue, 27 Jun 2023 17:01:35 +0200 (CEST)
From: Julia Lawall <julia.lawall@...ia.fr>
To: Dave Hansen <dave.hansen@...el.com>
cc: Jarkko Sakkinen <jarkko@...nel.org>,
kernel-janitors@...r.kernel.org, keescook@...omium.org,
christophe.jaillet@...adoo.fr, kuba@...nel.org,
Dave Hansen <dave.hansen@...ux.intel.com>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
linux-sgx@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 21/24] x86/sgx: use vmalloc_array and vcalloc
On Tue, 27 Jun 2023, Dave Hansen wrote:
> On 6/27/23 07:43, Julia Lawall wrote:
> > Use vmalloc_array and vcalloc to protect against
> > multiplication overflows.
> ...
> > diff -u -p a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
> > --- a/arch/x86/kernel/cpu/sgx/main.c
> > +++ b/arch/x86/kernel/cpu/sgx/main.c
> > @@ -628,7 +628,7 @@ static bool __init sgx_setup_epc_section
> > if (!section->virt_addr)
> > return false;
> >
> > - section->pages = vmalloc(nr_pages * sizeof(struct sgx_epc_page));
> > + section->pages = vmalloc_array(nr_pages, sizeof(struct sgx_epc_page));
> > if (!section->pages) {
>
> I'm not sure that changelog matches the code.
>
> 'nr_pages' here is an 'unsigned long' and The sizeof()==32. In
> practice, the multiplication can be done with a shift, and the ulong is
> a *LONG* way from overflowing.
>
> I'll accept that, as a general rule, vmalloc_array() is the preferred
> form. It's totally possible that someone could copy and paste the
> nr_foo*sizeof(struct bar) code over to a place where nr_foo is a more
> troublesome type.
>
> But, if that's the true motivation, could we please say that in the
> changelog? As it stands, it's a bit silly to be talking about
> multiplication overflows, unless I'm missing something totally obvious.
If it is certain that no overflow is possible, then perhaps it is fine to
drop the patch? I didn't change cases where both arguments are constants
nor where the result of the sizeof is 1. But I also didn't do a careful
analysis to see if an overflow is possible given the possible values
involved.
Or if it seems better to keep the change, I can also change the log
message.
julia
Powered by blists - more mailing lists