lkml.org 
[lkml]   [2004]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH] ALSA: Remove subsystem-specific malloc (1/8)
    * Arjan van de Ven (arjanv@redhat.com) wrote:
    >
    > > + */
    > > +void *kcalloc(size_t n, size_t size, int flags)
    > > +{
    > > + void *ret = kmalloc(n * size, flags);
    >
    > how about making sure n*size doesn't overflow an int in this function?
    > We had a few security holes due to that happening a while ago; might as
    > well prevent it from happening entirely

    Nice point. Too bad all we can return is NULL, it'd be nice to know the
    overflow was the reason. Do we plop a WARN_ON() in there for a while?
    Something like below (w/out any WARN_ON right now)?

    thanks,
    -chris
    --
    Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net

    diff -urN linux-2.6.6/include/linux/slab.h kcalloc-2.6.6/include/linux/slab.h
    --- linux-2.6.6/include/linux/slab.h 2004-06-09 22:56:11.874249056 +0300
    +++ kcalloc-2.6.6/include/linux/slab.h 2004-06-09 23:03:10.597593432 +0300
    @@ -95,6 +95,7 @@
    return __kmalloc(size, flags);
    }

    +extern void *kcalloc(size_t, size_t, int);
    extern void kfree(const void *);
    extern unsigned int ksize(const void *);

    diff -urN linux-2.6.6/mm/slab.c kcalloc-2.6.6/mm/slab.c
    --- linux-2.6.6/mm/slab.c 2004-06-09 22:59:13.081701336 +0300
    +++ kcalloc-2.6.6/mm/slab.c 2004-06-09 23:07:51.262925816 +0300
    @@ -2332,6 +2332,28 @@
    EXPORT_SYMBOL(kmem_cache_free);

    /**
    + * kcalloc - allocate memory for an array. The memory is set to zero.
    + * @n: number of elements.
    + * @size: element size.
    + * @flags: the type of memory to allocate.
    + */
    +void *kcalloc(size_t n, size_t size, int flags)
    +{
    + void *ret = NULL;
    +
    + /* check for overflow */
    + if (n > UINT_MAX/size)
    + return ret;
    +
    + ret = kmalloc(n * size, flags);
    + if (ret)
    + memset(ret, 0, n * size);
    + return ret;
    +}
    +
    +EXPORT_SYMBOL(kcalloc);
    +
    +/**
    * kfree - free previously allocated memory
    * @objp: pointer returned by kmalloc.
    *
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2005-03-22 14:03    [W:0.022 / U:178.344 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site