From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752036Ab3BLVWt (ORCPT ); Tue, 12 Feb 2013 16:22:49 -0500 Received: from fieldses.org ([174.143.236.118]:55714 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751077Ab3BLVWs (ORCPT ); Tue, 12 Feb 2013 16:22:48 -0500 Date: Tue, 12 Feb 2013 16:22:46 -0500 From: "J. Bruce Fields" To: Tim Gardner Cc: linux-kernel@vger.kernel.org, Trond Myklebust , linux-nfs@vger.kernel.org Subject: Re: [PATCH linux-next] lockd: nlmsvc_mark_resources(): avoid stack overflow Message-ID: <20130212212246.GH10267@fieldses.org> References: <1360698538-63040-1-git-send-email-tim.gardner@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1360698538-63040-1-git-send-email-tim.gardner@canonical.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Feb 12, 2013 at 12:48:58PM -0700, Tim Gardner wrote: > Dynamically allocate the NLM host structure in order to avoid stack overflow. > nlmsvc_mark_resources() is several call levels deep in a stack > that has a number of large variables. 512 bytes seems like a lot > on the stack at this point. > > smatch analysis: > > fs/lockd/svcsubs.c:366 nlmsvc_mark_resources() warn: 'hint' puts > 512 bytes on stack > > Cc: Trond Myklebust > Cc: "J. Bruce Fields" > Cc: linux-nfs@vger.kernel.org > Signed-off-by: Tim Gardner > --- > fs/lockd/svcsubs.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > > diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c > index b904f41..f3abb7f 100644 > --- a/fs/lockd/svcsubs.c > +++ b/fs/lockd/svcsubs.c > @@ -363,11 +363,15 @@ nlmsvc_is_client(void *data, struct nlm_host *dummy) > void > nlmsvc_mark_resources(struct net *net) > { > - struct nlm_host hint; > + struct nlm_host *hint = kzalloc(sizeof(*hint), GFP_KERNEL); > > - dprintk("lockd: nlmsvc_mark_resources for net %p\n", net); > - hint.net = net; > - nlm_traverse_files(&hint, nlmsvc_mark_host, NULL); > + if (hint) { > + dprintk("lockd: nlmsvc_mark_resources for net %p\n", net); > + hint->net = net; > + nlm_traverse_files(hint, nlmsvc_mark_host, NULL); > + } Silently neglecting to do this looks like a bad idea. It's strange that we're passing in an nlm_host when all we actually use is the struct net*. Why not just change this to pass in the net instead? --b. > + > + kfree(hint); > } > > /* > -- > 1.7.9.5 >