>-----Original Message-----
>From: Kees Cook <keesc...@chromium.org>
>Sent: Friday, September 23, 2022 4:28 PM
>To: Vlastimil Babka <vba...@suse.cz>
>Cc: Kees Cook <keesc...@chromium.org>; Brandeburg, Jesse
><jesse.brandeb...@intel.com>; Nguyen, Anthony L
><anthony.l.ngu...@intel.com>; David S. Miller <da...@davemloft.net>;
>Eric Dumazet <eduma...@google.com>; Jakub Kicinski <k...@kernel.org>;
>Paolo Abeni <pab...@redhat.com>; intel-wired-...@lists.osuosl.org;
>net...@vger.kernel.org; Ruhl, Michael J <michael.j.r...@intel.com>;
>Hyeonggon Yoo <42.hye...@gmail.com>; Christoph Lameter
><c...@linux.com>; Pekka Enberg <penb...@kernel.org>; David Rientjes
><rient...@google.com>; Joonsoo Kim <iamjoonsoo....@lge.com>; Andrew
>Morton <a...@linux-foundation.org>; Greg Kroah-Hartman
><gre...@linuxfoundation.org>; Nick Desaulniers
><ndesaulni...@google.com>; Alex Elder <el...@kernel.org>; Josef Bacik
><jo...@toxicpanda.com>; David Sterba <dste...@suse.com>; Sumit Semwal
><sumit.sem...@linaro.org>; Christian König <christian.koe...@amd.com>;
>Daniel Micay <danielmi...@gmail.com>; Yonghong Song <y...@fb.com>;
>Marco Elver <el...@google.com>; Miguel Ojeda <oj...@kernel.org>; linux-
>ker...@vger.kernel.org; linux...@kvack.org; linux-bt...@vger.kernel.org;
>linux-me...@vger.kernel.org; dri-devel@lists.freedesktop.org; linaro-mm-
>s...@lists.linaro.org; linux-fsde...@vger.kernel.org; d...@openvswitch.org;
>x...@kernel.org; l...@lists.linux.dev; linux-harden...@vger.kernel.org
>Subject: [PATCH v2 06/16] igb: Proactively round up to kmalloc bucket size
>
>In preparation for removing the "silently change allocation size"
>users of ksize(), explicitly round up all q_vector allocations so that
>allocations can be correctly compared to ksize().
>
>Additionally fix potential use-after-free in the case of new allocation
>failure: only free memory if the replacement allocation succeeds.
>
>Cc: Jesse Brandeburg <jesse.brandeb...@intel.com>
>Cc: Tony Nguyen <anthony.l.ngu...@intel.com>
>Cc: "David S. Miller" <da...@davemloft.net>
>Cc: Eric Dumazet <eduma...@google.com>
>Cc: Jakub Kicinski <k...@kernel.org>
>Cc: Paolo Abeni <pab...@redhat.com>
>Cc: intel-wired-...@lists.osuosl.org
>Cc: net...@vger.kernel.org
>Signed-off-by: Kees Cook <keesc...@chromium.org>
>---
> drivers/net/ethernet/intel/igb/igb_main.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/net/ethernet/intel/igb/igb_main.c
>b/drivers/net/ethernet/intel/igb/igb_main.c
>index 2796e81d2726..eb51e531c096 100644
>--- a/drivers/net/ethernet/intel/igb/igb_main.c
>+++ b/drivers/net/ethernet/intel/igb/igb_main.c
>@@ -1195,15 +1195,16 @@ static int igb_alloc_q_vector(struct igb_adapter
>*adapter,
> return -ENOMEM;
>
> ring_count = txr_count + rxr_count;
>- size = struct_size(q_vector, ring, ring_count);
>+ size = kmalloc_size_roundup(struct_size(q_vector, ring, ring_count));
This looks good to me...
> /* allocate q_vector and rings */
> q_vector = adapter->q_vector[v_idx];
> if (!q_vector) {
> q_vector = kzalloc(size, GFP_KERNEL);
> } else if (size > ksize(q_vector)) {
>- kfree_rcu(q_vector, rcu);
> q_vector = kzalloc(size, GFP_KERNEL);
>+ if (q_vector)
>+ kfree_rcu(q_vector, rcu);
Even though this is in the ksize part, this seems like an unrelated change?
Should this be in a different patch?
Also, the kfree_rcu will free q_vector after the RCU grace period?
Is that what you want to do?
How does rcu distinguish between the original q_vector, and the newly kzalloced
one?
Thanks,
Mike
> } else {
> memset(q_vector, 0, size);
> }
>--
>2.34.1
