>-----Original Message-----
>From: Kees Cook <[email protected]>
>Sent: Friday, September 23, 2022 4:28 PM
>To: Vlastimil Babka <[email protected]>
>Cc: Kees Cook <[email protected]>; Brandeburg, Jesse
><[email protected]>; Nguyen, Anthony L
><[email protected]>; David S. Miller <[email protected]>;
>Eric Dumazet <[email protected]>; Jakub Kicinski <[email protected]>;
>Paolo Abeni <[email protected]>; [email protected];
>[email protected]; Ruhl, Michael J <[email protected]>;
>Hyeonggon Yoo <[email protected]>; Christoph Lameter
><[email protected]>; Pekka Enberg <[email protected]>; David Rientjes
><[email protected]>; Joonsoo Kim <[email protected]>; Andrew
>Morton <[email protected]>; Greg Kroah-Hartman
><[email protected]>; Nick Desaulniers
><[email protected]>; Alex Elder <[email protected]>; Josef Bacik
><[email protected]>; David Sterba <[email protected]>; Sumit Semwal
><[email protected]>; Christian König <[email protected]>;
>Daniel Micay <[email protected]>; Yonghong Song <[email protected]>;
>Marco Elver <[email protected]>; Miguel Ojeda <[email protected]>; linux-
>[email protected]; [email protected]; [email protected];
>[email protected]; [email protected]; linaro-mm-
>[email protected]; [email protected]; [email protected];
>[email protected]; [email protected]; [email protected]
>Subject: [PATCH v2 06/16] igb: Proactively round up to kmalloc bucket size
>
>In preparation for removing the "silently change allocation size"
>users of ksize(), explicitly round up all q_vector allocations so that
>allocations can be correctly compared to ksize().
>
>Additionally fix potential use-after-free in the case of new allocation
>failure: only free memory if the replacement allocation succeeds.
>
>Cc: Jesse Brandeburg <[email protected]>
>Cc: Tony Nguyen <[email protected]>
>Cc: "David S. Miller" <[email protected]>
>Cc: Eric Dumazet <[email protected]>
>Cc: Jakub Kicinski <[email protected]>
>Cc: Paolo Abeni <[email protected]>
>Cc: [email protected]
>Cc: [email protected]
>Signed-off-by: Kees Cook <[email protected]>
>---
> drivers/net/ethernet/intel/igb/igb_main.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/net/ethernet/intel/igb/igb_main.c
>b/drivers/net/ethernet/intel/igb/igb_main.c
>index 2796e81d2726..eb51e531c096 100644
>--- a/drivers/net/ethernet/intel/igb/igb_main.c
>+++ b/drivers/net/ethernet/intel/igb/igb_main.c
>@@ -1195,15 +1195,16 @@ static int igb_alloc_q_vector(struct igb_adapter
>*adapter,
> return -ENOMEM;
>
> ring_count = txr_count + rxr_count;
>- size = struct_size(q_vector, ring, ring_count);
>+ size = kmalloc_size_roundup(struct_size(q_vector, ring, ring_count));
This looks good to me...
> /* allocate q_vector and rings */
> q_vector = adapter->q_vector[v_idx];
> if (!q_vector) {
> q_vector = kzalloc(size, GFP_KERNEL);
> } else if (size > ksize(q_vector)) {
>- kfree_rcu(q_vector, rcu);
> q_vector = kzalloc(size, GFP_KERNEL);
>+ if (q_vector)
>+ kfree_rcu(q_vector, rcu);
Even though this is in the ksize part, this seems like an unrelated change?
Should this be in a different patch?
Also, the kfree_rcu will free q_vector after the RCU grace period?
Is that what you want to do?
How does rcu distinguish between the original q_vector, and the newly kzalloced
one?
Thanks,
Mike
> } else {
> memset(q_vector, 0, size);
> }
>--
>2.34.1
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
