Messages in this thread Patch in this message | | | Date | Wed, 9 Jun 2004 13:57:12 -0700 | From | Chris Wright <> | Subject | Re: [PATCH] ALSA: Remove subsystem-specific malloc (1/8) |
| |
* Arjan van de Ven (arjanv@redhat.com) wrote: > > > + */ > > +void *kcalloc(size_t n, size_t size, int flags) > > +{ > > + void *ret = kmalloc(n * size, flags); > > how about making sure n*size doesn't overflow an int in this function? > We had a few security holes due to that happening a while ago; might as > well prevent it from happening entirely
Nice point. Too bad all we can return is NULL, it'd be nice to know the overflow was the reason. Do we plop a WARN_ON() in there for a while? Something like below (w/out any WARN_ON right now)?
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
diff -urN linux-2.6.6/include/linux/slab.h kcalloc-2.6.6/include/linux/slab.h --- linux-2.6.6/include/linux/slab.h 2004-06-09 22:56:11.874249056 +0300 +++ kcalloc-2.6.6/include/linux/slab.h 2004-06-09 23:03:10.597593432 +0300 @@ -95,6 +95,7 @@ return __kmalloc(size, flags); } +extern void *kcalloc(size_t, size_t, int); extern void kfree(const void *); extern unsigned int ksize(const void *); diff -urN linux-2.6.6/mm/slab.c kcalloc-2.6.6/mm/slab.c --- linux-2.6.6/mm/slab.c 2004-06-09 22:59:13.081701336 +0300 +++ kcalloc-2.6.6/mm/slab.c 2004-06-09 23:07:51.262925816 +0300 @@ -2332,6 +2332,28 @@ EXPORT_SYMBOL(kmem_cache_free); /** + * kcalloc - allocate memory for an array. The memory is set to zero. + * @n: number of elements. + * @size: element size. + * @flags: the type of memory to allocate. + */ +void *kcalloc(size_t n, size_t size, int flags) +{ + void *ret = NULL; + + /* check for overflow */ + if (n > UINT_MAX/size) + return ret; + + ret = kmalloc(n * size, flags); + if (ret) + memset(ret, 0, n * size); + return ret; +} + +EXPORT_SYMBOL(kcalloc); + +/** * kfree - free previously allocated memory * @objp: pointer returned by kmalloc. * - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |