Messages in this thread | | | Date | Thu, 2 Dec 2021 09:13:44 +0900 | From | Masami Hiramatsu <> | Subject | Re: [PATCH] kprobes: Limit max data_size of the kretprobe instances |
| |
On Wed, 1 Dec 2021 11:19:22 -0500 Steven Rostedt <rostedt@goodmis.org> wrote:
> On Wed, 1 Dec 2021 23:45:50 +0900 > Masami Hiramatsu <mhiramat@kernel.org> wrote: > > > The kretprobe::data_size is unsigned (size_t) but it is > > used as 'data_size + sizeof(struct kretprobe_instance)'. > > Thus, it can be smaller than sizeof(struct kretprobe_instance) > > while allocating memory for the kretprobe_instance. > > The above doesn't make sense. > > data_size is unsigned but it is used as > 'data_size + sizeof(struct kretprobe_instance)'. > > What does that mean? > > What can be smaller than sizeof(struct kretprobe_instance) and why does it > matter?
OK, what about this ?
The 'kprobe::data_size' is unsigned, thus it can not be negative. But if user sets it enough big number (e.g. (size_t)-8), the result of 'data_size + sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct kretprobe_instance) or zero. In result, the kretprobe_instance are allocated without enough memory, and kretprobe accesses outside of allocated memory.
Thank you,
-- Masami Hiramatsu <mhiramat@kernel.org>
| |