linux-kernel - [PATCH 2/2] fs: select: reduce stack usage in do_sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230716010714.3009192-2-chao@kernel.org>
Date:   Sun, 16 Jul 2023 09:07:14 +0800
From:   Chao Yu <chao@...nel.org>
To:     viro@...iv.linux.org.uk, brauner@...nel.org,
        linux-fsdevel@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Chao Yu <chao@...nel.org>
Subject: [PATCH 2/2] fs: select: reduce stack usage in do_sys_poll()

struct poll_wqueues table caused the stack usage of do_sys_poll() to
grow beyond the warning limit on 32-bit architectures w/ gcc.

fs/select.c: In function ‘do_sys_poll’:
fs/select.c:1053:1: warning: the frame size of 1328 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Allocating dynamic memory in do_sys_poll() to fix this issue.

Signed-off-by: Chao Yu <chao@...nel.org>
---
 fs/select.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/fs/select.c b/fs/select.c
index 1b729494b4e9..2b9db5c938d9 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -982,7 +982,7 @@ static int do_poll(struct poll_list *list, struct poll_wqueues *wait,
 static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
 		struct timespec64 *end_time)
 {
-	struct poll_wqueues table;
+	struct poll_wqueues *table;
 	int err = -EFAULT, fdcount, len;
 	/* Allocate small arguments on the stack to save memory and be
 	   faster - use long to make sure the buffer is aligned properly
@@ -992,8 +992,14 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
  	struct poll_list *walk = head;
  	unsigned long todo = nfds;
 
-	if (nfds > rlimit(RLIMIT_NOFILE))
-		return -EINVAL;
+	table = kmalloc(sizeof(struct poll_wqueues), GFP_KERNEL);
+	if (!table)
+		return -ENOMEM;
+
+	if (nfds > rlimit(RLIMIT_NOFILE)) {
+		err = -EINVAL;
+		goto out_table;
+	}
 
 	len = min_t(unsigned int, nfds, N_STACK_PPS);
 	for (;;) {
@@ -1019,9 +1025,9 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
 		}
 	}
 
-	poll_initwait(&table);
-	fdcount = do_poll(head, &table, end_time);
-	poll_freewait(&table);
+	poll_initwait(table);
+	fdcount = do_poll(head, table, end_time);
+	poll_freewait(table);
 
 	if (!user_write_access_begin(ufds, nfds * sizeof(*ufds)))
 		goto out_fds;
@@ -1043,7 +1049,8 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
 		walk = walk->next;
 		kfree(pos);
 	}
-
+out_table:
+	kfree(table);
 	return err;
 
 Efault:
-- 
2.40.1