From: Douglas Gilbert <dgilbert@interlog.com>
To: Jason Gunthorpe <jgg@ziepe.ca>
Cc: linux-scsi@vger.kernel.org, linux-block@vger.kernel.org,
target-devel@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-kernel@vger.kernel.org, martin.petersen@oracle.com,
jejb@linux.vnet.ibm.com, bostroesser@gmail.com, ddiss@suse.de,
bvanassche@acm.org
Subject: Re: [PATCH v6 1/4] sgl_alloc_order: remove 4 GiB limit, sgl_free() warning
Date: Mon, 18 Jan 2021 15:08:51 -0500 [thread overview]
Message-ID: <59707b66-0b6c-b397-82fe-5ad6a6f99ba1@interlog.com> (raw)
In-Reply-To: <20210118182854.GJ4605@ziepe.ca>
On 2021-01-18 1:28 p.m., Jason Gunthorpe wrote:
> On Mon, Jan 18, 2021 at 11:30:03AM -0500, Douglas Gilbert wrote:
>
>> After several flawed attempts to detect overflow, take the fastest
>> route by stating as a pre-condition that the 'order' function argument
>> cannot exceed 16 (2^16 * 4k = 256 MiB).
>
> That doesn't help, the point of the overflow check is similar to
> overflow checks in kcalloc: to prevent the routine from allocating
> less memory than the caller might assume.
>
> For instance ipr_store_update_fw() uses request_firmware() (which is
> controlled by userspace) to drive the length argument to
> sgl_alloc_order(). If userpace gives too large a value this will
> corrupt kernel memory.
>
> So this math:
>
> nent = round_up(length, PAGE_SIZE << order) >> (PAGE_SHIFT + order);
But that check itself overflows if order is too large (e.g. 65).
A pre-condition says that the caller must know or check a value
is sane, and if the user space can have a hand in the value passed
the caller _must_ check pre-conditions IMO. A pre-condition also
implies that the function's implementation will not have code to
check the pre-condition.
My "log of both sides" proposal at least got around the overflowing
left shift problem. And one reviewer, Bodo Stroesser, liked it.
> Needs to be checked, add a precondition to order does not help. I
> already proposed a straightforward algorithm you can use.
It does help, it stops your proposed check from being flawed :-)
Giving a false sense of security seems more dangerous than a
pre-condition statement IMO. Bart's original overflow check (in
the mainline) limits length to 4GB (due to wrapping inside a 32
bit unsigned).
Also note there is another pre-condition statement in that function's
definition, namely that length cannot be 0.
So perhaps you, Bart Van Assche and Bodo Stroesser, should compare
notes and come up with a solution that you are _all_ happy with.
The pre-condition works for me and is the fastest. The 'length'
argument might be large, say > 1 GB [I use 1 GB in testing but
did try 4GB and found the bug I'm trying to fix] but having
individual elements greater than say 32 MB each does not
seem very practical (and fails on the systems that I test with).
In my testing the largest element size is 4 MB.
Doug Gilbert
next prev parent reply other threads:[~2021-01-18 20:10 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-18 16:30 [PATCH v6 0/4] scatterlist: add new capabilities Douglas Gilbert
2021-01-18 16:30 ` [PATCH v6 1/4] sgl_alloc_order: remove 4 GiB limit, sgl_free() warning Douglas Gilbert
2021-01-18 18:28 ` Jason Gunthorpe
2021-01-18 20:08 ` Douglas Gilbert [this message]
2021-01-18 20:24 ` Jason Gunthorpe
2021-01-18 21:22 ` Bodo Stroesser
2021-01-18 23:48 ` Jason Gunthorpe
2021-01-19 1:27 ` Douglas Gilbert
2021-01-19 12:59 ` Jason Gunthorpe
2021-01-19 17:24 ` Bodo Stroesser
2021-01-19 18:03 ` Jason Gunthorpe
2021-01-19 18:08 ` Bodo Stroesser
2021-01-19 18:17 ` Jason Gunthorpe
2021-01-19 18:39 ` Bodo Stroesser
2021-01-18 20:46 ` Bodo Stroesser
2021-01-18 16:30 ` [PATCH v6 2/4] scatterlist: add sgl_copy_sgl() function Douglas Gilbert
2021-01-18 16:30 ` [PATCH v6 3/4] scatterlist: add sgl_compare_sgl() function Douglas Gilbert
2021-01-18 23:27 ` David Disseldorp
2021-01-19 1:04 ` Douglas Gilbert
2021-01-19 11:50 ` David Disseldorp
2021-01-18 16:30 ` [PATCH v6 4/4] scatterlist: add sgl_memset() Douglas Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=59707b66-0b6c-b397-82fe-5ad6a6f99ba1@interlog.com \
--to=dgilbert@interlog.com \
--cc=bostroesser@gmail.com \
--cc=bvanassche@acm.org \
--cc=ddiss@suse.de \
--cc=jejb@linux.vnet.ibm.com \
--cc=jgg@ziepe.ca \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).