All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: akpm@linux-foundation.org, linux-mm@kvack.org
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Subject: [PATCH v2] mm: memdup_user*() should use same gfp flags
Date: Wed, 20 Jan 2021 19:34:36 +0900	[thread overview]
Message-ID: <20210120103436.11830-1-penguin-kernel@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <20210120041843.5090-1-penguin-kernel@I-love.SAKURA.ne.jp>

syzbot is reporting that memdup_user_nul() which receives user-controlled
size (which can be up to (INT_MAX & PAGE_MASK)) via vfs_write() will hit
order >= MAX_ORDER path [1].

Let's add __GFP_NOWARN to memdup_user_nul() as with commit 6c8fcc096be9d02f
("mm: don't let userspace spam allocations warnings"). Also use GFP_USER as
with commit 6c2c97a24f096e32 ("memdup_user(): switch to GFP_USER").

[1] https://syzkaller.appspot.com/bug?id=8bf7efb3db19101b4008dc9198522ef977d098a6

Reported-by: syzbot <syzbot+a71a442385a0b2815497@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 mm/util.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/mm/util.c b/mm/util.c
index 8c9b7d1e7c49..265b40a86856 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -252,12 +252,7 @@ void *memdup_user_nul(const void __user *src, size_t len)
 {
 	char *p;
 
-	/*
-	 * Always use GFP_KERNEL, since copy_from_user() can sleep and
-	 * cause pagefault, which makes it pointless to use GFP_NOFS
-	 * or GFP_ATOMIC.
-	 */
-	p = kmalloc_track_caller(len + 1, GFP_KERNEL);
+	p = kmalloc_track_caller(len + 1, GFP_USER | __GFP_NOWARN);
 	if (!p)
 		return ERR_PTR(-ENOMEM);
 
-- 
2.18.4



  reply	other threads:[~2021-01-20 10:34 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-20  4:18 [PATCH] mm: add __GFP_NOWARN to memdup_user_nul() Tetsuo Handa
2021-01-20 10:34 ` Tetsuo Handa [this message]
2021-01-22  1:35   ` [PATCH v2] mm: memdup_user*() should use same gfp flags Andrew Morton
2021-01-22 10:47     ` Tetsuo Handa
2021-01-25 13:32       ` Michal Hocko
2021-01-25 14:20         ` Tetsuo Handa
2021-01-25 15:44           ` Michal Hocko
2021-01-26 11:13             ` Sabyrzhan Tasbolatov
2021-01-27 10:55               ` [PATCH v3] " Tetsuo Handa
2021-01-27 11:59                 ` Michal Hocko
2021-01-27 12:17                   ` Michal Hocko
     [not found]                     ` <3e01b180-0a5b-f2aa-6247-1c3bbcabe1ed@i-love.sakura.ne.jp>
2021-01-27 23:19                       ` Andrew Morton
2021-01-27 23:27                         ` Casey Schaufler
2021-01-28  7:42                           ` Tetsuo Handa
2021-01-28  8:06                         ` Michal Hocko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210120103436.11830-1-penguin-kernel@I-love.SAKURA.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=akpm@linux-foundation.org \
    --cc=linux-mm@kvack.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.