lkml.org 
[lkml]   [2011]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 1/4] cpuset: Remove unneeded NODEMASK_ALLOC() in cpuset_sprintf_memlist()
    Paul Menage wrote:
    > On Wed, Feb 16, 2011 at 5:49 PM, Li Zefan <lizf@cn.fujitsu.com> wrote:
    >> It's not necessary to copy cpuset->mems_allowed to a buffer
    >> allocated by NODEMASK_ALLOC(). Just pass it to nodelist_scnprintf().
    >>
    >> Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    >
    > Acked-by: Paul Menage <menage@google.com>
    >
    > The only downside is that we're now doing more work (and more complex
    > work) inside callback_mutex, but I guess that's OK compared to having
    > to do a memory allocation. (I poked around in lib/vsprintf.c and I
    > couldn't see any cases where it might allocate memory, but it would be
    > particularly bad if there was any way to trigger an Oops.)
    >
    >> ---
    >> kernel/cpuset.c | 10 +---------
    >> 1 files changed, 1 insertions(+), 9 deletions(-)
    >>
    >> diff --git a/kernel/cpuset.c b/kernel/cpuset.c
    >> index 10f1835..f13ff2e 100644
    >> --- a/kernel/cpuset.c
    >> +++ b/kernel/cpuset.c
    >> @@ -1620,20 +1620,12 @@ static int cpuset_sprintf_cpulist(char *page, struct cpuset *cs)
    >>
    >> static int cpuset_sprintf_memlist(char *page, struct cpuset *cs)
    >> {
    >> - NODEMASK_ALLOC(nodemask_t, mask, GFP_KERNEL);
    >> int retval;
    >>
    >> - if (mask == NULL)
    >> - return -ENOMEM;
    >> -
    >
    > And this was particularly broken since the only caller of
    > cpuset_sprintf_memlist() doesn't handle a negative error response
    > anyway and would then overwrite byte 4083 on the preceding page with a
    > '\n'. And then since the (size_t)(s-page) that's passed to
    > simple_read_from_buffer() would be a very large number, it would write
    > arbitrary (user-controlled) amounts of kernel data to the userspace
    > buffer.
    >
    > Maybe we could also rename 'retval' to 'count' in this function (and
    > cpuset_sprintf_cpulist()) to make it clearer that callers don't expect
    > negative error values?
    >

    Good spot!


    \
     
     \ /
      Last update: 2011-02-18 03:23    [W:0.023 / U:2.016 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site