linux-kernel - Re: [PATCH v2] tracing/osnoise: Replace kmalloc + copy_from_user with memdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250930172841.63dc86b5@gandalf.local.home>
Date: Tue, 30 Sep 2025 17:28:41 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Thorsten Blum <thorsten.blum@...ux.dev>
Cc: Masami Hiramatsu <mhiramat@...nel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH v2] tracing/osnoise: Replace kmalloc + copy_from_user
 with memdup_user

On Thu, 25 Sep 2025 23:17:36 +0200
Thorsten Blum <thorsten.blum@...ux.dev> wrote:


>  #ifdef CONFIG_X86_LOCAL_APIC
> @@ -2325,12 +2326,9 @@ osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count,
>  	if (count < 1)
>  		return 0;
>  
> -	buf = kmalloc(count, GFP_KERNEL);
> -	if (!buf)
> -		return -ENOMEM;
> -
> -	if (copy_from_user(buf, ubuf, count))
> -		return -EFAULT;
> +	buf = memdup_user(ubuf, count);
> +	if (IS_ERR(buf))
> +		return PTR_ERR(buf);

After adding this to my for-next branch, it failed to merge with upstream.
That's because a bug was found that if user space did not have a '\0'
terminator, reading this as a string could cause the read to go off the
allocated buffer and crash the machine.

>  
>  	if (!zalloc_cpumask_var(&osnoise_cpumask_new, GFP_KERNEL))
>  		return -ENOMEM;

The above was changed to this:

	if (count < 1)
		return 0;

	buf = kmalloc(count + 1, GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	if (copy_from_user(buf, ubuf, count))
		return -EFAULT;
	buf[count] = '\0';

Which makes your change not quite compatible.

I'm going to rebase and remove your change for now.

-- Steve