lkml.org 
[lkml]   [2013]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subjectslab: krealloc with GFP_ZERO defect
From
Date
This sequence can return non-zeroed memory from the
padding area of the original allocation.

ptr = kzalloc(foo, GFP_KERNEL);
if (!ptr)
...
new_ptr = krealloc(ptr, foo + bar, GFP_KERNEL | __GFP_ZERO);

If the realloc size is within the first actual allocation
then the additional memory is not zeroed.

If the realloc size is not within the original allocation
size, any non-zeroed padding from the original allocation
is overwriting newly allocated zeroed memory.

Maybe someone more familiar with the alignment & padding can
add the proper memset(,0,) for the __GFP_ZERO cases and also
optimize kmalloc_track_caller to not use __GFP_ZERO, memcpy
the current (non padded) size and zero the newly returned
remainder if necessary.

from: mm/util.c
---------------------------
static __always_inline void *__do_krealloc(const void *p, size_t new_size,
gfp_t flags)
{
void *ret;
size_t ks = 0;

if (p)
ks = ksize(p);

if (ks >= new_size)
return (void *)p;

ret = kmalloc_track_caller(new_size, flags);
if (ret && p)
memcpy(ret, p, ks);

return ret;
}




\
 
 \ /
  Last update: 2013-08-30 00:21    [W:0.049 / U:0.644 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site