netdev - Re: [PATCH] hv_netvsc: Add check for kvmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 14 Mar 2022 09:13:59 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Jiasheng Jiang <jiasheng@...as.ac.cn>
Cc:     stephen@...workplumber.org, kys@...rosoft.com,
        haiyangz@...rosoft.com, sthemmin@...rosoft.com, wei.liu@...nel.org,
        decui@...rosoft.com, davem@...emloft.net, kuba@...nel.org,
        ast@...nel.org, daniel@...earbox.net, hawk@...nel.org,
        john.fastabend@...il.com, andrii@...nel.org, kafai@...com,
        songliubraving@...com, yhs@...com, kpsingh@...nel.org,
        linux-hyperv@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH] hv_netvsc: Add check for kvmalloc_array

On Mon, Mar 14, 2022 at 04:05:14PM +0800, Jiasheng Jiang wrote:
> On Mon, Mar 14, 2022 at 03:33:49PM +0800, Greg KH wrote:
> >> Thanks, I have tested the patch by kernel_patch_verify,
> > 
> > What is that?
> 
> It a Linux kernel patch static verification helper tool.
> Link: https://github.com/nmenon/kernel_patch_verify
> 
> >> and all the tests are passed.
> > 
> > What tests exactly?  How did you fail this allocation?
> 
> The failure of allocation is not included in the tests.
> And as far as I know, there is not any tool that has the
> ability to fail the allocation.

There are tools that do this.

> But I think that for safety, the cost of redundant and harmless
> check is acceptable.
> Also, checking after allocation is a good program pattern.

That's fine, it's how you clean up that is the problem that not everyone
gets correct, which is why it is good to verify that you do not
introduce problems.

greg k-h