linux-kernel - Re: [PATCH] ipv4: fib: Fix fib_info_hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89BC8935-21D1-45A9-AEA1-A4E52D193434@kernel.org>
Date: Mon, 28 Apr 2025 20:52:59 -0700
From: Kees Cook <kees@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...zon.com>, dsahern@...nel.org
CC: davem@...emloft.net, edumazet@...gle.com, horms@...nel.org, kuba@...nel.org,
 kuniyu@...zon.com, linux-hardening@...r.kernel.org,
 linux-kernel@...r.kernel.org, netdev@...r.kernel.org, pabeni@...hat.com
Subject: Re: [PATCH] ipv4: fib: Fix fib_info_hash_alloc() allocation type



On April 28, 2025 5:43:05 PM PDT, Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
>Thanks for CC me, David.
>
>From: David Ahern <dsahern@...nel.org>
>Date: Mon, 28 Apr 2025 16:50:53 -0600
>> On 4/25/25 11:05 PM, Kees Cook wrote:
>> > In preparation for making the kmalloc family of allocators type aware,
>> > we need to make sure that the returned type from the allocation matches
>> > the type of the variable being assigned. (Before, the allocator would
>> > always return "void *", which can be implicitly cast to any pointer type.)
>> > 
>> > This was allocating many sizeof(struct hlist_head *) when it actually
>> > wanted sizeof(struct hlist_head). Luckily these are the same size.
>> > Adjust the allocation type to match the assignment.
>> > 
>> > Signed-off-by: Kees Cook <kees@...nel.org>
>> > ---
>> > Cc: "David S. Miller" <davem@...emloft.net>
>> > Cc: David Ahern <dsahern@...nel.org>
>> > Cc: Eric Dumazet <edumazet@...gle.com>
>> > Cc: Jakub Kicinski <kuba@...nel.org>
>> > Cc: Paolo Abeni <pabeni@...hat.com>
>> > Cc: Simon Horman <horms@...nel.org>
>> > Cc: <netdev@...r.kernel.org>
>> > ---
>> >  net/ipv4/fib_semantics.c | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> > 
>> > diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
>> > index f68bb9e34c34..37d12b0bc6be 100644
>> > --- a/net/ipv4/fib_semantics.c
>> > +++ b/net/ipv4/fib_semantics.c
>> > @@ -365,7 +365,7 @@ static struct hlist_head *fib_info_laddrhash_bucket(const struct net *net,
>> >  static struct hlist_head *fib_info_hash_alloc(unsigned int hash_bits)
>> >  {
>> >  	/* The second half is used for prefsrc */
>> > -	return kvcalloc((1 << hash_bits) * 2, sizeof(struct hlist_head *),
>> > +	return kvcalloc((1 << hash_bits) * 2, sizeof(struct hlist_head),
>> >  			GFP_KERNEL);
>> >  }
>> >  
>> 
>> Reviewed-by: David Ahern <dsahern@...nel.org>
>> 
>> Fixes: fa336adc100e ("ipv4: fib: Allocate fib_info_hash[] and
>> fib_info_laddrhash[] by kvcalloc().)
>
>I agree this should target net.git as the last statement
>will be false with LOCKDEP.

Which will be false with lockdep? Unless I'm missing it, I think hlist_head is always pointer sized:

struct hlist_head {
	struct hlist_node *first;
};

>
>Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Thanks!

-- 
Kees Cook