lkml.org 
[lkml]   [2001]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: kernel BUG at slab.c:1542!(2.4.1-pre9)
    Daniel Phillips wrote:
    >
    > I don't know much about the history of this bug but it's quite clear
    > it's deliberately inserted:
    >
    > void * kmalloc (size_t size, int flags)
    > <if allocation succeeds, exit>
    > BUG(); // too big size
    > return NULL;
    >

    I sent the below patch to Linus earlier today. I didn't copy
    any mailing list because it's a bit security-related. Oh well.

    If wmem_max is set to > 256kbytes, an application can
    set SO_SNDBUF on a unix domain stream socket to >256k
    and do a write() of >256k. unix_stream_sendmsg()
    then tries to kmalloc >128k and the kernel dies.

    I don't like the idea of simply returning NULL from kmalloc in
    this case, because an application which does

    setsockopt(fd, SOL_SOCKET, SO_SNDBUF, 256kbytes);
    write(fd, buf, 256kbytes);

    will work perfectly well, until someone increases wmem_max
    to greater than 256k. This administrative action will
    cause the above application to mysteriously start failing.




    --- linux-2.4.1-pre10/include/linux/slab.h Mon Jan 1 18:29:35 2001
    +++ linux-akpm/include/linux/slab.h Wed Jan 24 12:29:34 2001
    @@ -75,6 +75,9 @@
    extern kmem_cache_t *fs_cachep;
    extern kmem_cache_t *sigact_cachep;

    +/* Largest kmalloc which we support */
    +extern size_t kmalloc_max;
    +
    #endif /* __KERNEL__ */

    #endif /* _LINUX_SLAB_H */
    --- linux-2.4.1-pre10/mm/slab.c Tue Jan 23 19:28:16 2001
    +++ linux-akpm/mm/slab.c Wed Jan 24 12:57:47 2001
    @@ -360,6 +360,9 @@
    /* Place maintainer for reaping. */
    static kmem_cache_t *clock_searchp = &cache_cache;

    +/* Largest kmalloc which we support */
    +size_t kmalloc_max;
    +
    #define cache_chain (cache_cache.next)

    #ifdef CONFIG_SMP
    @@ -455,6 +458,7 @@
    SLAB_CACHE_DMA|SLAB_HWCACHE_ALIGN, NULL, NULL);
    if (!sizes->cs_dmacachep)
    BUG();
    + kmalloc_max = sizes->cs_size;
    sizes++;
    } while (sizes->cs_size);
    }
    --- linux-2.4.1-pre10/kernel/ksyms.c Tue Jan 23 19:28:16 2001
    +++ linux-akpm/kernel/ksyms.c Wed Jan 24 12:17:28 2001
    @@ -104,6 +104,7 @@
    EXPORT_SYMBOL(kmem_cache_alloc);
    EXPORT_SYMBOL(kmem_cache_free);
    EXPORT_SYMBOL(kmalloc);
    +EXPORT_SYMBOL(kmalloc_max);
    EXPORT_SYMBOL(kfree);
    EXPORT_SYMBOL(vfree);
    EXPORT_SYMBOL(__vmalloc);
    --- linux-2.4.1-pre10/net/unix/af_unix.c Tue Jan 23 19:28:16 2001
    +++ linux-akpm/net/unix/af_unix.c Wed Jan 24 12:57:35 2001
    @@ -1319,6 +1319,10 @@
    if (size > sk->sndbuf/2 - 16)
    size = sk->sndbuf/2 - 16;

    + /* Avoid oversized kmallocs */
    + if (size > kmalloc_max / 2 - 16)
    + size = kmalloc_max / 2 - 16;
    +
    /*
    * Keep to page sized kmalloc()'s as various people
    * have suggested. Big mallocs stress the vm too
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2005-03-22 13:22    [W:0.025 / U:93.660 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site