* [PATCH] fscache: fscache_set_key() - align alloc and usage
@ 2018-07-22 11:05 Tomas Bortoli
2018-08-03 13:49 ` David Howells
0 siblings, 1 reply; 3+ messages in thread
From: Tomas Bortoli @ 2018-07-22 11:05 UTC (permalink / raw)
To: dhowells; +Cc: linux-cachefs, linux-kernel, syzkaller, Tomas Bortoli
The fscache_set_key() function allocates the buf pointer if index_key_len > sizeof(cookie->inline_key).
In such cases the allocated space might not be aligned with the pointer type.
This may result in an out-of-bound in the for-loop later in the same function, as the counter is rounded up.
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com
---
fs/fscache/cookie.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 97137d7ec5ee..ed28bfb6a0fe 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -98,7 +98,7 @@ static int fscache_set_key(struct fscache_cookie *cookie,
cookie->key_len = index_key_len;
if (index_key_len > sizeof(cookie->inline_key)) {
- buf = kzalloc(index_key_len, GFP_KERNEL);
+ buf = kzalloc(round_up(index_key_len, sizeof(u32)), GFP_KERNEL);
if (!buf)
return -ENOMEM;
cookie->key = buf;
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] fscache: fscache_set_key() - align alloc and usage
2018-07-22 11:05 [PATCH] fscache: fscache_set_key() - align alloc and usage Tomas Bortoli
@ 2018-08-03 13:49 ` David Howells
2018-08-03 17:26 ` Tomas Bortoli
0 siblings, 1 reply; 3+ messages in thread
From: David Howells @ 2018-08-03 13:49 UTC (permalink / raw)
To: Tomas Bortoli; +Cc: dhowells, linux-cachefs, linux-kernel, syzkaller
Tomas Bortoli <tomasbortoli@gmail.com> wrote:
> The fscache_set_key() function allocates the buf pointer if index_key_len >
> sizeof(cookie->inline_key). In such cases the allocated space might not be
> aligned with the pointer type. This may result in an out-of-bound in the
> for-loop later in the same function, as the counter is rounded up.
Yeah, it's good idea anyway since I should tell the allocator everything that
I expect to use - though kmalloc() will effectively rounds up the size to a
multiple of 8 anyway (ie. the smallest allocation granule is 8 bytes).
David
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] fscache: fscache_set_key() - align alloc and usage
2018-08-03 13:49 ` David Howells
@ 2018-08-03 17:26 ` Tomas Bortoli
0 siblings, 0 replies; 3+ messages in thread
From: Tomas Bortoli @ 2018-08-03 17:26 UTC (permalink / raw)
To: David Howells; +Cc: linux-cachefs, linux-kernel, syzkaller
On 08/03/2018 03:49 PM, David Howells wrote:
> Tomas Bortoli <tomasbortoli@gmail.com> wrote:
>
>> The fscache_set_key() function allocates the buf pointer if index_key_len >
>> sizeof(cookie->inline_key). In such cases the allocated space might not be
>> aligned with the pointer type. This may result in an out-of-bound in the
>> for-loop later in the same function, as the counter is rounded up.
>
> Yeah, it's good idea anyway since I should tell the allocator everything that
> I expect to use - though kmalloc() will effectively rounds up the size to a
> multiple of 8 anyway (ie. the smallest allocation granule is 8 bytes).
>
> David
>
Yeah I forgot that :) at least KASAN won't complain anymore.
Tomas
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-08-03 17:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-22 11:05 [PATCH] fscache: fscache_set_key() - align alloc and usage Tomas Bortoli
2018-08-03 13:49 ` David Howells
2018-08-03 17:26 ` Tomas Bortoli
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.