netdev - Re: [PATCH] [PATCH v2] net: skb: guard kmalloc_reserve() against oversized allocations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+3Lin=ZZZzzEXKLrWU=vyLWmUEoeTAE_4_N_fKvRYVmg@mail.gmail.com>
Date: Sat, 20 Sep 2025 13:19:24 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: Kriish Sharma <kriish.sharma2006@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, horms@...nel.org, 
	willemb@...gle.com, kerneljasonxing@...il.com, martin.lau@...nel.org, 
	mhal@...x.co, almasrymina@...gle.com, ebiggers@...gle.com, 
	aleksander.lobakin@...el.com, netdev@...r.kernel.org, 
	linux-kernel@...r.kernel.org, skhan@...uxfoundation.org, 
	syzbot+5a2250fd91b28106c37b@...kaller.appspotmail.com
Subject: Re: [PATCH] [PATCH v2] net: skb: guard kmalloc_reserve() against
 oversized allocations

On Sat, Sep 20, 2025 at 1:12 PM Kriish Sharma
<kriish.sharma2006@...il.com> wrote:
>
> Add an explicit size check in kmalloc_reserve() to reject requests
> larger than KMALLOC_MAX_SIZE before they reach the allocator.
>
> syzbot reported warnings triggered by attempts to allocate buffers
> with an object size exceeding KMALLOC_MAX_SIZE. While the existing
> code relies on kmalloc() failure and a comment states that truncation
> is "harmless", in practice this causes high-order allocation warnings
> and noisy kernel logs that interfere with testing.
>
> This patch introduces an early guard in kmalloc_reserve() that returns
> NULL if obj_size exceeds KMALLOC_MAX_SIZE. This ensures impossible
> requests fail fast and silently, avoiding allocator warnings while
> keeping the intended semantics unchanged.
>
> Fixes: 7fa4d8dc380f ("Add linux-next specific files for 20250821")
> Reported-by: syzbot+5a2250fd91b28106c37b@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5a2250fd91b28106c37b
>
> ---
> v2:
>  - Add WARN_ONCE() to make oversized allocations visible
>
> Signed-off-by: Kriish Sharma <kriish.sharma2006@...il.com>
> ---
>  net/core/skbuff.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index ee0274417948..70588f98c07e 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -591,6 +591,13 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
>         /* The following cast might truncate high-order bits of obj_size, this
>          * is harmless because kmalloc(obj_size >= 2^32) will fail anyway.
>          */
> +       if (unlikely(obj_size > KMALLOC_MAX_SIZE)) {
> +               WARN_ONCE(1,
> +                         "%s: request size %zu exceeds KMALLOC_MAX_SIZE (%lu)\n",
> +                         __func__, obj_size, KMALLOC_MAX_SIZE);
> +               return NULL;
> +       }
> +

You are essentially duplicating a warning, which already exists.

You can be sure syzbot will hit hit this warning.

Instead, please fix usbnet.