lkml.org 
[lkml]   [2013]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] fs: make sure we do not read beyond allocation
In dentry_string_cmp (via__d_lookup_rcu), when CONFIG_DCACHE_WORD_ACCESS
is set, word-width memory reads are performed. However, the string
allocation size may not be a multiple of the word size. To avoid reading
past the end of such an allocation, we must allocate in multiples of
the word size.

Found by the Kernel Address Sanitizer project:
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
fs/dcache.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 4100030..23665e2 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1570,7 +1570,11 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
*/
dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
if (name->len > DNAME_INLINE_LEN-1) {
- dname = kmalloc(name->len + 1, GFP_KERNEL);
+ size_t alloc_size = name->len + 1;
+#ifdef CONFIG_DCACHE_WORD_ACCESS
+ alloc_size = round_up(alloc_size, sizeof(unsigned long));
+#endif
+ dname = kmalloc(alloc_size, GFP_KERNEL);
if (!dname) {
kmem_cache_free(dentry_cache, dentry);
return NULL;
--
1.7.9.5

--
Kees Cook
Chrome OS Security


\
 
 \ /
  Last update: 2013-10-03 19:01    [W:0.084 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site