Re: [RFC] memdup_user() and friends

On Sun, Jan 7, 2018 at 4:16 AM, Al Viro wrote: > What I propose is > * switch memdup_user() to GFP_USER > * add vmemdup_user(), using kvmalloc() instead of kmalloc() (also with > GFP_USER) Perhaps kvmemdup_user() for sake of consistency? > *

Re: [RFC] memdup_user() and friends

On Sun, Jan 7, 2018 at 4:16 AM, Al Viro wrote: > What I propose is > * switch memdup_user() to GFP_USER > * add vmemdup_user(), using kvmalloc() instead of kmalloc() (also with > GFP_USER) Perhaps kvmemdup_user() for sake of consistency? > * switch open-coded instances

Re: [RFC] memdup_user() and friends

On Sun, Jan 07, 2018 at 02:16:56AM +, Al Viro wrote: ... > > Everything else is definitely fine with GFP_USER - it's stuff like "copy of > ioctl > arguments in an ioctl never issued by the kernel code, must have come > straight from > ioctl(2)" and things like that. IMO we should simply

Re: [RFC] memdup_user() and friends

On Sun, Jan 07, 2018 at 02:16:56AM +, Al Viro wrote: ... > > Everything else is definitely fine with GFP_USER - it's stuff like "copy of > ioctl > arguments in an ioctl never issued by the kernel code, must have come > straight from > ioctl(2)" and things like that. IMO we should simply

Re: [RFC] memdup_user() and friends

> Objections? No objections in particular except the amount of mirrored allocator interfaces is getting pretty ridiculous. Another thing, blindly changing kmalloc+copy_from_user to memdup_user can be wrong because of GFP_KERNEL_ACCOUNT if the memory is allocated persistently.

Re: [RFC] memdup_user() and friends

> Objections? No objections in particular except the amount of mirrored allocator interfaces is getting pretty ridiculous. Another thing, blindly changing kmalloc+copy_from_user to memdup_user can be wrong because of GFP_KERNEL_ACCOUNT if the memory is allocated persistently.

[RFC] memdup_user() and friends

After reviewing memdup_user() callers, I've found several places where it got completely unbounded values passed for size (up to 2Gb), as well as some bounded by ridiculously high values - e.g. if (size > 1024 * 128) /* sane value */ return -EINVAL;

[RFC] memdup_user() and friends

After reviewing memdup_user() callers, I've found several places where it got completely unbounded values passed for size (up to 2Gb), as well as some bounded by ridiculously high values - e.g. if (size > 1024 * 128) /* sane value */ return -EINVAL;