Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/24/14 11:48, Lai Jiangshan wrote:
>
> 326cf0f0f308 ("idr: fix top layer handling") enlarged the pa array.
> But the additional "+1" space is only used in id-allocation, it is free
> in other usage, (paa may point to the additional "+1" space, but not
> dereference it).
> so you can reuse it.
>
> In the 3 functions your patch touched:
> - struct idr_layer ***paa = [0];
> + struct idr_layer ***paa = [1];
>
Yeah, I thought about such change, but decided this will look very confusing.
Though, this could be made less confusing with good comment why we are assigning
pointer to second element.
I'm think that we should also initialize pa[0] in such case, to avoid possible
kmemchek's report
about uninitialized memory read.
>
> I don't reject your patch, I had review it.
>
> Reviewed-by: Lai Jiangshan
>
> The reason why I'm still muttering here is that I wish a simple solution
> to fix the problem. And:
> 1) your patch also makes use of the additional "+1" @pa space: *++paa = p
> 2) your patch may slight enlarge the function body.
> 3) I think you patch reduces the readability a little although the idr code
>itself is already shit.
>
I have no strong opinion about what change is better. They both looks shitty to
me.
The best solution here would be to rewrite this whole code from scratch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
326cf0f0f308 ("idr: fix top layer handling") enlarged the pa array.
But the additional "+1" space is only used in id-allocation, it is free
in other usage, (paa may point to the additional "+1" space, but not
dereference it).
so you can reuse it.
In the 3 functions your patch touched:
- struct idr_layer ***paa = [0];
+ struct idr_layer ***paa = [1];
I don't reject your patch, I had review it.
Reviewed-by: Lai Jiangshan
The reason why I'm still muttering here is that I wish a simple solution
to fix the problem. And:
1) your patch also makes use of the additional "+1" @pa space: *++paa = p
2) your patch may slight enlarge the function body.
3) I think you patch reduces the readability a little although the idr code
itself is already shit.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
326cf0f0f308 (idr: fix top layer handling) enlarged the pa array. But the additional +1 space is only used in id-allocation, it is free in other usage, (paa may point to the additional +1 space, but not dereference it). so you can reuse it. In the 3 functions your patch touched: - struct idr_layer ***paa = pa[0]; + struct idr_layer ***paa = pa[1]; I don't reject your patch, I had review it. Reviewed-by: Lai Jiangshan la...@cn.fujitsu.com The reason why I'm still muttering here is that I wish a simple solution to fix the problem. And: 1) your patch also makes use of the additional +1 @pa space: *++paa = p 2) your patch may slight enlarge the function body. 3) I think you patch reduces the readability a little although the idr code itself is already shit. -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/24/14 11:48, Lai Jiangshan wrote: 326cf0f0f308 (idr: fix top layer handling) enlarged the pa array. But the additional +1 space is only used in id-allocation, it is free in other usage, (paa may point to the additional +1 space, but not dereference it). so you can reuse it. In the 3 functions your patch touched: - struct idr_layer ***paa = pa[0]; + struct idr_layer ***paa = pa[1]; Yeah, I thought about such change, but decided this will look very confusing. Though, this could be made less confusing with good comment why we are assigning pointer to second element. I'm think that we should also initialize pa[0] in such case, to avoid possible kmemchek's report about uninitialized memory read. I don't reject your patch, I had review it. Reviewed-by: Lai Jiangshan la...@cn.fujitsu.com The reason why I'm still muttering here is that I wish a simple solution to fix the problem. And: 1) your patch also makes use of the additional +1 @pa space: *++paa = p 2) your patch may slight enlarge the function body. 3) I think you patch reduces the readability a little although the idr code itself is already shit. I have no strong opinion about what change is better. They both looks shitty to me. The best solution here would be to rewrite this whole code from scratch. -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/24/14 05:26, Lai Jiangshan wrote:
> On 06/23/2014 09:37 PM, Andrey Ryabinin wrote:
>> I'm working on address sanitizer project for kernel. Recently we started
>> experiments with stack instrumentation, to detect out-of-bounds
>> read/write bugs on stack.
>>
>> Just after booting I've hit out-of-bounds read on stack in idr_for_each
>> (and in __idr_remove_all as well):
>>
>> struct idr_layer **paa = [0];
>>
>> while (id >= 0 && id <= max) {
>> ...
>> while (n < fls(id)) {
>> n += IDR_BITS;
>> p = *--paa; <--- here we are reading pa[-1] value.
>> }
>> }
>
> I prefer to moving the loop-exit-condition-checking code down:
>
> if (id < 0 || id > max) /* only idr_get_next() needs this
> branch */
> return ...
>
> for (;;) { /* move out from here */
> ...
> increase the @id;
> if (id < 0 || id > max) /* move to here */
> break;
> while (n < fls(id)) {
> ...
> }
> }
>
This will work only for idr_for_each and idr_get_new, but not for
__idr_remove_all, since we have to to free layers
in second loop:
while (n < fls(id ^ bt_mask)) {
if (p)
free_layer(idp, p);
n += IDR_BITS;
p = *--paa;
}
>
>>
>> Despite the fact that after this dereference we are exiting out of loop and
>> never use p, such behaviour is undefined and should be avoided.
>>
>> Fix this by moving pointer derference to the beggining of the loop, right
>> before we will use it.
>>
>> Signed-off-by: Andrey Ryabinin
>> ---
>> lib/idr.c | 25 ++---
>> 1 file changed, 14 insertions(+), 11 deletions(-)
>>
>> diff --git a/lib/idr.c b/lib/idr.c
>> index 39158ab..50be3fa 100644
>> --- a/lib/idr.c
>> +++ b/lib/idr.c
>> @@ -590,26 +590,27 @@ static void __idr_remove_all(struct idr *idp)
>> struct idr_layer **paa = [0];
>>
>> n = idp->layers * IDR_BITS;
>> -p = idp->top;
>> +*paa = idp->top;
>> RCU_INIT_POINTER(idp->top, NULL);
>> max = idr_max(idp->layers);
>>
>> id = 0;
>> while (id >= 0 && id <= max) {
>> +p = *paa;
>> while (n > IDR_BITS && p) {
>> n -= IDR_BITS;
>> -*paa++ = p;
>> p = p->ary[(id >> n) & IDR_MASK];
>> +*++paa = p;
>> }
>>
>> bt_mask = id;
>> id += 1 << n;
>> /* Get the highest bit that the above add changed from 0->1. */
>> while (n < fls(id ^ bt_mask)) {
>> -if (p)
>> -free_layer(idp, p);
>> +if (*paa)
>> +free_layer(idp, *paa);
>> n += IDR_BITS;
>> -p = *--paa;
>> +--paa;
>> }
>> }
>> idp->layers = 0;
>> @@ -692,15 +693,16 @@ int idr_for_each(struct idr *idp,
>> struct idr_layer **paa = [0];
>>
>> n = idp->layers * IDR_BITS;
>> -p = rcu_dereference_raw(idp->top);
>> +*paa = rcu_dereference_raw(idp->top);
>> max = idr_max(idp->layers);
>>
>> id = 0;
>> while (id >= 0 && id <= max) {
>> +p = *paa;
>> while (n > 0 && p) {
>> n -= IDR_BITS;
>> -*paa++ = p;
>> p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
>> +*++paa = p;
>> }
>>
>> if (p) {
>> @@ -712,7 +714,7 @@ int idr_for_each(struct idr *idp,
>> id += 1 << n;
>> while (n < fls(id)) {
>> n += IDR_BITS;
>> -p = *--paa;
>> +--paa;
>> }
>> }
>>
>> @@ -740,17 +742,18 @@ void *idr_get_next(struct idr *idp, int *nextidp)
>> int n, max;
>>
>> /* find first ent */
>> -p = rcu_dereference_raw(idp->top);
>> +p = *paa = rcu_dereference_raw(idp->top);
>> if (!p)
>> return NULL;
>> n = (p->layer + 1) * IDR_BITS;
>> max = idr_max(p->layer + 1);
>>
>> while (id >= 0 && id <= max) {
>> +p = *paa;
>> while (n > 0 && p) {
>> n -= IDR_BITS;
>> -*paa++ = p;
>> p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
>> +*++paa = p;
>> }
>>
>> if (p) {
>> @@ -768,7 +771,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
>> id = round_up(id + 1, 1 << n);
>> while (n < fls(id)) {
>> n += IDR_BITS;
>> -p = *--paa;
>> +--paa;
>>
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/23/2014 09:37 PM, Andrey Ryabinin wrote:
> I'm working on address sanitizer project for kernel. Recently we started
> experiments with stack instrumentation, to detect out-of-bounds
> read/write bugs on stack.
>
> Just after booting I've hit out-of-bounds read on stack in idr_for_each
> (and in __idr_remove_all as well):
>
> struct idr_layer **paa = [0];
>
> while (id >= 0 && id <= max) {
> ...
> while (n < fls(id)) {
> n += IDR_BITS;
> p = *--paa; <--- here we are reading pa[-1] value.
> }
> }
I prefer to moving the loop-exit-condition-checking code down:
if (id < 0 || id > max) /* only idr_get_next() needs this
branch */
return ...
for (;;) { /* move out from here */
...
increase the @id;
if (id < 0 || id > max) /* move to here */
break;
while (n < fls(id)) {
...
}
}
>
> Despite the fact that after this dereference we are exiting out of loop and
> never use p, such behaviour is undefined and should be avoided.
>
> Fix this by moving pointer derference to the beggining of the loop, right
> before we will use it.
>
> Signed-off-by: Andrey Ryabinin
> ---
> lib/idr.c | 25 ++---
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
> diff --git a/lib/idr.c b/lib/idr.c
> index 39158ab..50be3fa 100644
> --- a/lib/idr.c
> +++ b/lib/idr.c
> @@ -590,26 +590,27 @@ static void __idr_remove_all(struct idr *idp)
> struct idr_layer **paa = [0];
>
> n = idp->layers * IDR_BITS;
> - p = idp->top;
> + *paa = idp->top;
> RCU_INIT_POINTER(idp->top, NULL);
> max = idr_max(idp->layers);
>
> id = 0;
> while (id >= 0 && id <= max) {
> + p = *paa;
> while (n > IDR_BITS && p) {
> n -= IDR_BITS;
> - *paa++ = p;
> p = p->ary[(id >> n) & IDR_MASK];
> + *++paa = p;
> }
>
> bt_mask = id;
> id += 1 << n;
> /* Get the highest bit that the above add changed from 0->1. */
> while (n < fls(id ^ bt_mask)) {
> - if (p)
> - free_layer(idp, p);
> + if (*paa)
> + free_layer(idp, *paa);
> n += IDR_BITS;
> - p = *--paa;
> + --paa;
> }
> }
> idp->layers = 0;
> @@ -692,15 +693,16 @@ int idr_for_each(struct idr *idp,
> struct idr_layer **paa = [0];
>
> n = idp->layers * IDR_BITS;
> - p = rcu_dereference_raw(idp->top);
> + *paa = rcu_dereference_raw(idp->top);
> max = idr_max(idp->layers);
>
> id = 0;
> while (id >= 0 && id <= max) {
> + p = *paa;
> while (n > 0 && p) {
> n -= IDR_BITS;
> - *paa++ = p;
> p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
> + *++paa = p;
> }
>
> if (p) {
> @@ -712,7 +714,7 @@ int idr_for_each(struct idr *idp,
> id += 1 << n;
> while (n < fls(id)) {
> n += IDR_BITS;
> - p = *--paa;
> + --paa;
> }
> }
>
> @@ -740,17 +742,18 @@ void *idr_get_next(struct idr *idp, int *nextidp)
> int n, max;
>
> /* find first ent */
> - p = rcu_dereference_raw(idp->top);
> + p = *paa = rcu_dereference_raw(idp->top);
> if (!p)
> return NULL;
> n = (p->layer + 1) * IDR_BITS;
> max = idr_max(p->layer + 1);
>
> while (id >= 0 && id <= max) {
> + p = *paa;
> while (n > 0 && p) {
> n -= IDR_BITS;
> - *paa++ = p;
> p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
> + *++paa = p;
> }
>
> if (p) {
> @@ -768,7 +771,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
> id = round_up(id + 1, 1 << n);
> while (n < fls(id)) {
> n += IDR_BITS;
> - p = *--paa;
> + --paa;
> }
> }
> return NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/23/2014 09:37 PM, Andrey Ryabinin wrote:
I'm working on address sanitizer project for kernel. Recently we started
experiments with stack instrumentation, to detect out-of-bounds
read/write bugs on stack.
Just after booting I've hit out-of-bounds read on stack in idr_for_each
(and in __idr_remove_all as well):
struct idr_layer **paa = pa[0];
while (id = 0 id = max) {
...
while (n fls(id)) {
n += IDR_BITS;
p = *--paa; --- here we are reading pa[-1] value.
}
}
I prefer to moving the loop-exit-condition-checking code down:
if (id 0 || id max) /* only idr_get_next() needs this
branch */
return ...
for (;;) { /* move out from here */
...
increase the @id;
if (id 0 || id max) /* move to here */
break;
while (n fls(id)) {
...
}
}
Despite the fact that after this dereference we are exiting out of loop and
never use p, such behaviour is undefined and should be avoided.
Fix this by moving pointer derference to the beggining of the loop, right
before we will use it.
Signed-off-by: Andrey Ryabinin a.ryabi...@samsung.com
---
lib/idr.c | 25 ++---
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/lib/idr.c b/lib/idr.c
index 39158ab..50be3fa 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -590,26 +590,27 @@ static void __idr_remove_all(struct idr *idp)
struct idr_layer **paa = pa[0];
n = idp-layers * IDR_BITS;
- p = idp-top;
+ *paa = idp-top;
RCU_INIT_POINTER(idp-top, NULL);
max = idr_max(idp-layers);
id = 0;
while (id = 0 id = max) {
+ p = *paa;
while (n IDR_BITS p) {
n -= IDR_BITS;
- *paa++ = p;
p = p-ary[(id n) IDR_MASK];
+ *++paa = p;
}
bt_mask = id;
id += 1 n;
/* Get the highest bit that the above add changed from 0-1. */
while (n fls(id ^ bt_mask)) {
- if (p)
- free_layer(idp, p);
+ if (*paa)
+ free_layer(idp, *paa);
n += IDR_BITS;
- p = *--paa;
+ --paa;
}
}
idp-layers = 0;
@@ -692,15 +693,16 @@ int idr_for_each(struct idr *idp,
struct idr_layer **paa = pa[0];
n = idp-layers * IDR_BITS;
- p = rcu_dereference_raw(idp-top);
+ *paa = rcu_dereference_raw(idp-top);
max = idr_max(idp-layers);
id = 0;
while (id = 0 id = max) {
+ p = *paa;
while (n 0 p) {
n -= IDR_BITS;
- *paa++ = p;
p = rcu_dereference_raw(p-ary[(id n) IDR_MASK]);
+ *++paa = p;
}
if (p) {
@@ -712,7 +714,7 @@ int idr_for_each(struct idr *idp,
id += 1 n;
while (n fls(id)) {
n += IDR_BITS;
- p = *--paa;
+ --paa;
}
}
@@ -740,17 +742,18 @@ void *idr_get_next(struct idr *idp, int *nextidp)
int n, max;
/* find first ent */
- p = rcu_dereference_raw(idp-top);
+ p = *paa = rcu_dereference_raw(idp-top);
if (!p)
return NULL;
n = (p-layer + 1) * IDR_BITS;
max = idr_max(p-layer + 1);
while (id = 0 id = max) {
+ p = *paa;
while (n 0 p) {
n -= IDR_BITS;
- *paa++ = p;
p = rcu_dereference_raw(p-ary[(id n) IDR_MASK]);
+ *++paa = p;
}
if (p) {
@@ -768,7 +771,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
id = round_up(id + 1, 1 n);
while (n fls(id)) {
n += IDR_BITS;
- p = *--paa;
+ --paa;
}
}
return NULL;
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] lib: idr: fix out-of-bounds pointer dereference
On 06/24/14 05:26, Lai Jiangshan wrote:
On 06/23/2014 09:37 PM, Andrey Ryabinin wrote:
I'm working on address sanitizer project for kernel. Recently we started
experiments with stack instrumentation, to detect out-of-bounds
read/write bugs on stack.
Just after booting I've hit out-of-bounds read on stack in idr_for_each
(and in __idr_remove_all as well):
struct idr_layer **paa = pa[0];
while (id = 0 id = max) {
...
while (n fls(id)) {
n += IDR_BITS;
p = *--paa; --- here we are reading pa[-1] value.
}
}
I prefer to moving the loop-exit-condition-checking code down:
if (id 0 || id max) /* only idr_get_next() needs this
branch */
return ...
for (;;) { /* move out from here */
...
increase the @id;
if (id 0 || id max) /* move to here */
break;
while (n fls(id)) {
...
}
}
This will work only for idr_for_each and idr_get_new, but not for
__idr_remove_all, since we have to to free layers
in second loop:
while (n fls(id ^ bt_mask)) {
if (p)
free_layer(idp, p);
n += IDR_BITS;
p = *--paa;
}
Despite the fact that after this dereference we are exiting out of loop and
never use p, such behaviour is undefined and should be avoided.
Fix this by moving pointer derference to the beggining of the loop, right
before we will use it.
Signed-off-by: Andrey Ryabinin a.ryabi...@samsung.com
---
lib/idr.c | 25 ++---
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/lib/idr.c b/lib/idr.c
index 39158ab..50be3fa 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -590,26 +590,27 @@ static void __idr_remove_all(struct idr *idp)
struct idr_layer **paa = pa[0];
n = idp-layers * IDR_BITS;
-p = idp-top;
+*paa = idp-top;
RCU_INIT_POINTER(idp-top, NULL);
max = idr_max(idp-layers);
id = 0;
while (id = 0 id = max) {
+p = *paa;
while (n IDR_BITS p) {
n -= IDR_BITS;
-*paa++ = p;
p = p-ary[(id n) IDR_MASK];
+*++paa = p;
}
bt_mask = id;
id += 1 n;
/* Get the highest bit that the above add changed from 0-1. */
while (n fls(id ^ bt_mask)) {
-if (p)
-free_layer(idp, p);
+if (*paa)
+free_layer(idp, *paa);
n += IDR_BITS;
-p = *--paa;
+--paa;
}
}
idp-layers = 0;
@@ -692,15 +693,16 @@ int idr_for_each(struct idr *idp,
struct idr_layer **paa = pa[0];
n = idp-layers * IDR_BITS;
-p = rcu_dereference_raw(idp-top);
+*paa = rcu_dereference_raw(idp-top);
max = idr_max(idp-layers);
id = 0;
while (id = 0 id = max) {
+p = *paa;
while (n 0 p) {
n -= IDR_BITS;
-*paa++ = p;
p = rcu_dereference_raw(p-ary[(id n) IDR_MASK]);
+*++paa = p;
}
if (p) {
@@ -712,7 +714,7 @@ int idr_for_each(struct idr *idp,
id += 1 n;
while (n fls(id)) {
n += IDR_BITS;
-p = *--paa;
+--paa;
}
}
@@ -740,17 +742,18 @@ void *idr_get_next(struct idr *idp, int *nextidp)
int n, max;
/* find first ent */
-p = rcu_dereference_raw(idp-top);
+p = *paa = rcu_dereference_raw(idp-top);
if (!p)
return NULL;
n = (p-layer + 1) * IDR_BITS;
max = idr_max(p-layer + 1);
while (id = 0 id = max) {
+p = *paa;
while (n 0 p) {
n -= IDR_BITS;
-*paa++ = p;
p = rcu_dereference_raw(p-ary[(id n) IDR_MASK]);
+*++paa = p;
}
if (p) {
@@ -768,7 +771,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
id = round_up(id + 1, 1 n);
while (n fls(id)) {
n += IDR_BITS;
-p = *--paa;
+--paa;
}
}
return NULL;
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
