Messages in this thread | | | Date | Mon, 18 Jan 2021 14:28:54 -0400 | From | Jason Gunthorpe <> | Subject | Re: [PATCH v6 1/4] sgl_alloc_order: remove 4 GiB limit, sgl_free() warning |
| |
On Mon, Jan 18, 2021 at 11:30:03AM -0500, Douglas Gilbert wrote:
> After several flawed attempts to detect overflow, take the fastest > route by stating as a pre-condition that the 'order' function argument > cannot exceed 16 (2^16 * 4k = 256 MiB).
That doesn't help, the point of the overflow check is similar to overflow checks in kcalloc: to prevent the routine from allocating less memory than the caller might assume.
For instance ipr_store_update_fw() uses request_firmware() (which is controlled by userspace) to drive the length argument to sgl_alloc_order(). If userpace gives too large a value this will corrupt kernel memory.
So this math:
nent = round_up(length, PAGE_SIZE << order) >> (PAGE_SHIFT + order);
Needs to be checked, add a precondition to order does not help. I already proposed a straightforward algorithm you can use.
Jason
| |