From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 678A9C433F5 for ; Mon, 4 Oct 2021 13:42:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4F10360F59 for ; Mon, 4 Oct 2021 13:42:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238799AbhJDNoH (ORCPT ); Mon, 4 Oct 2021 09:44:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:51804 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238255AbhJDNl5 (ORCPT ); Mon, 4 Oct 2021 09:41:57 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 1911761B47; Mon, 4 Oct 2021 13:19:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1633353548; bh=4J6b+pGnhyClF6/EOFwei6emV3s8HYLl1o7osLBs+OY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lcxr5yzs/SbUoLlAHV3EFo0hZH7aatsWZdRTYz0wTvfngIZ1HKUNEnqj1i45TBwRf WzzAkMM7gotX2SsiGWaj34MW5B5wlxBSlfxetChfkAp7QJ7BtnxIzOHCNf/fLwFEpO QGGzTNpe/nkOI7VXzVyV0HwEHVvu6ruMjyNBWeEg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Willy Tarreau , Kees Cook , Linus Torvalds Subject: [PATCH 5.14 165/172] mm: dont allow oversized kvmalloc() calls Date: Mon, 4 Oct 2021 14:53:35 +0200 Message-Id: <20211004125050.299434484@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211004125044.945314266@linuxfoundation.org> References: <20211004125044.945314266@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus Torvalds commit 7661809d493b426e979f39ab512e3adf41fbcc69 upstream. 'kvmalloc()' is a convenience function for people who want to do a kmalloc() but fall back on vmalloc() if there aren't enough physically contiguous pages, or if the allocation is larger than what kmalloc() supports. However, let's make sure it doesn't get _too_ easy to do crazy things with it. In particular, don't allow big allocations that could be due to integer overflow or underflow. So make sure the allocation size fits in an 'int', to protect against trivial integer conversion issues. Acked-by: Willy Tarreau Cc: Kees Cook Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/util.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/mm/util.c +++ b/mm/util.c @@ -593,6 +593,10 @@ void *kvmalloc_node(size_t size, gfp_t f if (ret || size <= PAGE_SIZE) return ret; + /* Don't even allow crazy sizes */ + if (WARN_ON_ONCE(size > INT_MAX)) + return NULL; + return __vmalloc_node(size, 1, flags, node, __builtin_return_address(0)); }