lkml.org 
[lkml]   [2004]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] ALSA: Remove subsystem-specific malloc (1/8)
* Arjan van de Ven (arjanv@redhat.com) wrote:
>
> > + */
> > +void *kcalloc(size_t n, size_t size, int flags)
> > +{
> > + void *ret = kmalloc(n * size, flags);
>
> how about making sure n*size doesn't overflow an int in this function?
> We had a few security holes due to that happening a while ago; might as
> well prevent it from happening entirely

Nice point. Too bad all we can return is NULL, it'd be nice to know the
overflow was the reason. Do we plop a WARN_ON() in there for a while?
Something like below (w/out any WARN_ON right now)?

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net

diff -urN linux-2.6.6/include/linux/slab.h kcalloc-2.6.6/include/linux/slab.h
--- linux-2.6.6/include/linux/slab.h 2004-06-09 22:56:11.874249056 +0300
+++ kcalloc-2.6.6/include/linux/slab.h 2004-06-09 23:03:10.597593432 +0300
@@ -95,6 +95,7 @@
return __kmalloc(size, flags);
}

+extern void *kcalloc(size_t, size_t, int);
extern void kfree(const void *);
extern unsigned int ksize(const void *);

diff -urN linux-2.6.6/mm/slab.c kcalloc-2.6.6/mm/slab.c
--- linux-2.6.6/mm/slab.c 2004-06-09 22:59:13.081701336 +0300
+++ kcalloc-2.6.6/mm/slab.c 2004-06-09 23:07:51.262925816 +0300
@@ -2332,6 +2332,28 @@
EXPORT_SYMBOL(kmem_cache_free);

/**
+ * kcalloc - allocate memory for an array. The memory is set to zero.
+ * @n: number of elements.
+ * @size: element size.
+ * @flags: the type of memory to allocate.
+ */
+void *kcalloc(size_t n, size_t size, int flags)
+{
+ void *ret = NULL;
+
+ /* check for overflow */
+ if (n > UINT_MAX/size)
+ return ret;
+
+ ret = kmalloc(n * size, flags);
+ if (ret)
+ memset(ret, 0, n * size);
+ return ret;
+}
+
+EXPORT_SYMBOL(kcalloc);
+
+/**
* kfree - free previously allocated memory
* @objp: pointer returned by kmalloc.
*
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 14:03    [from the cache]
©2003-2011 Jasper Spaans