lkml.org 
[lkml]   [2012]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH RFC v2] slab: introduce kmalloc_array
From
Date
On Feb 14, 2012, at 10:02 AM, Christoph Lameter wrote:
> We could also catch these issues with BUG() or WARN_ON() and then return
> zero.

You cannot have SAFE_ARRAY_SIZE return 0 when an integer overflow
occurs.

1) kmalloc(0) has a different semantics.

2) Using kmalloc(0) allows DoS attacks because often after kmalloc()
there is some initialization code that writes to the allocated
memory, such as:

p = kmalloc(SAFE_ARRAY_SIZE(n, size), ...);
for (i = 0; i < n; ++i)
p[i] = ...;

Besides, BUG() still allows DoS attacks and WARN_ON() would flood
the log, especially if n is controlled from user space. Neither
seems appropriate here.

- xi


\
 
 \ /
  Last update: 2012-02-14 17:33    [from the cache]
©2003-2011 Jasper Spaans