Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1280092
| Path | csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> |
| Newsgroups | linux.kernel |
| Subject | [PATCH] sctp: use GFP_USER for user-controlled kmalloc |
| Date | Mon, 30 Nov 2015 17:40:02 +0100 |
| Message-ID | <qAzEC-62E-13@gated-at.bofh.it> (permalink) |
| References | <qAzEC-62E-15@gated-at.bofh.it> |
| X-Original-To | netdev@vger.kernel.org |
| X-Scanned-By | MIMEDefang 2.68 on 10.5.11.27 |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 44 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | linux-sctp@vger.kernel.org, Vlad Yasevich <vyasevich@gmail.com>, Neil Horman <nhorman@tuxdriver.com>, daniel@iogearbox.net, linux-kernel@vger.kernel.org, davem@davemloft.net, syzkaller@googlegroups.com, dvyukov@google.com, kcc@google.com, glider@google.com, sasha.levin@oracle.com, edumazet@google.com |
| X-Original-Date | Mon, 30 Nov 2015 14:32:54 -0200 |
| X-Original-Message-ID | <db23659cdf84bc80aff45e906cbfb67581e7a125.1448901154.git.marcelo.leitner@gmail.com> |
| X-Original-References | <CACT4Y+a_V5WQZNEnYkuA3Xc5qCWmLV3oScNeNiATZm-wW5eg3Q@mail.gmail.comc> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1280092 |
Show key headers only | View raw
Dmitry Vyukov reported that the user could trigger a kernel warning by using a large len value for getsockopt SCTP_GET_LOCAL_ADDRS, as that value directly affects the value used as a kmalloc() parameter. This patch thus switches the allocation flags from all user-controllable kmalloc size to GFP_USER to put some more restrictions on it and also disables the warn, as they are not necessary. Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> --- net/sctp/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 897c01c029cab3d5805cc56b0964c70e06f4143a..676b3bb092e16848fd1c822e1c999af4a2ef198d 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -972,7 +972,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, return -EFAULT; /* Alloc space for the address array in kernel memory. */ - kaddrs = kmalloc(addrs_size, GFP_KERNEL); + kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN); if (unlikely(!kaddrs)) return -ENOMEM; @@ -4928,7 +4928,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, to = optval + offsetof(struct sctp_getaddrs, addrs); space_left = len - offsetof(struct sctp_getaddrs, addrs); - addrs = kmalloc(space_left, GFP_KERNEL); + addrs = kmalloc(space_left, GFP_USER | __GFP_NOWARN); if (!addrs) return -ENOMEM; -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
[PATCH] sctp: use GFP_USER for user-controlled kmalloc Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2015-11-30 17:40 +0100
RE: [PATCH] sctp: use GFP_USER for user-controlled kmalloc David Laight <David.Laight@ACULAB.COM> - 2015-12-01 11:50 +0100
Re: [PATCH] sctp: use GFP_USER for user-controlled kmalloc Daniel Borkmann <daniel@iogearbox.net> - 2015-12-01 12:30 +0100
Re: [PATCH] sctp: use GFP_USER for user-controlled kmalloc David Miller <davem@davemloft.net> - 2015-12-03 05:50 +0100
csiph-web