lkml.org 
[lkml]   [2012]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] kmsg: limit message size
    On Wed, May 9, 2012 at 12:57 AM, Andrew Morton
    <akpm@linux-foundation.org> wrote:
    > On Sat,  5 May 2012 16:56:12 +0200
    > Sasha Levin <levinsasha928@gmail.com> wrote:
    >
    >> There are no size checks in kmsg_write(), and we try allocating enough
    >> memory to store everything userspace gave us, which may be too much for
    >> kmalloc to allocate.
    >>
    >> Furthermore, we can have an integer overflow if len==INT_MAX, in that case
    >> we'll corrupt kernel memory.
    >>
    >> This was tested with several userspace programs that write to kmsg, and haven't
    >> found a case where the program attempts to write more than PAGE_SIZE.
    >>
    >> Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    >> ---
    >>  drivers/char/mem.c |    3 +++
    >>  1 files changed, 3 insertions(+), 0 deletions(-)
    >>
    >> diff --git a/drivers/char/mem.c b/drivers/char/mem.c
    >> index d6e9d08..c90964b 100644
    >> --- a/drivers/char/mem.c
    >> +++ b/drivers/char/mem.c
    >> @@ -815,6 +815,9 @@ static ssize_t kmsg_writev(struct kiocb *iocb, const struct iovec *iv,
    >>       ssize_t ret = -EFAULT;
    >>       size_t len = iov_length(iv, count);
    >>
    >> +     if (len > PAGE_SIZE)
    >> +             return -E2BIG;
    >> +
    >>       line = kmalloc(len + 1, GFP_KERNEL);
    >>       if (line == NULL)
    >>               return -ENOMEM;
    >
    > Well, this is a write(), and write() is permitted to return
    > less-than-asked-for.  So what we could do here is to write the first N
    > bytes and then return N to userspace.  Well-behaved userspace will
    > notice this and then do some more writing from offset N.
    >
    > Could I ask that you try this and test it a bit, see whether there is
    > any well-behaved userspace out there?  Things like cat and echo
    > _should_ dtrt.

    Yup, cat and echo do dtrt. I'll resend a patch which limits the write
    instead of canceling it altogether.
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2012-05-10 18:41    [W:0.038 / U:0.336 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site