Messages in this thread | | | Subject | Re: Potentially unbounded allocations in seq_read? | From | Tvrtko Ursulin <> | Date | Wed, 11 Dec 2013 17:48:32 +0000 |
| |
On Wed, 2013-12-11 at 17:04 +0000, Tvrtko Ursulin wrote: > Hi all, > > It seems that the buffer allocation in seq_read can double in size > indefinitely, at least I've seen that in practice with /proc/<pid>/smaps > (attempting to double m->size to 4M on a read of 1000 bytes). This > produces an ugly WARN_ON_ONCE, which should perhaps be avoided? (given > that it can be triggered by userspace at will) > > From the top comment in seq_file.c one would think that it is a > fundamental limitation of the current code that everything which will be > read (even if in chunks) needs to be in the kernel side buffer at the > same time?
Oh-oh, seems that m->size is doubled on every read. So if app is reading with a buffer smaller than data available, it can do nine reads before it hits a >MAX_ORDER allocation. Not good. :)
Regards,
Tvrtko
| |