[lkml]   [2012]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH RFC v2] slab: introduce kmalloc_array
    On Feb 14, 2012, at 10:02 AM, Christoph Lameter wrote:
    > We could also catch these issues with BUG() or WARN_ON() and then return
    > zero.

    You cannot have SAFE_ARRAY_SIZE return 0 when an integer overflow

    1) kmalloc(0) has a different semantics.

    2) Using kmalloc(0) allows DoS attacks because often after kmalloc()
    there is some initialization code that writes to the allocated
    memory, such as:

    p = kmalloc(SAFE_ARRAY_SIZE(n, size), ...);
    for (i = 0; i < n; ++i)
    p[i] = ...;

    Besides, BUG() still allows DoS attacks and WARN_ON() would flood
    the log, especially if n is controlled from user space. Neither
    seems appropriate here.

    - xi

     \ /
      Last update: 2012-02-14 17:33    [W:0.019 / U:0.844 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site