lkml.org 
[lkml]   [2021]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] kprobes: Limit max data_size of the kretprobe instances
On Wed, 1 Dec 2021 11:19:22 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Wed, 1 Dec 2021 23:45:50 +0900
> Masami Hiramatsu <mhiramat@kernel.org> wrote:
>
> > The kretprobe::data_size is unsigned (size_t) but it is
> > used as 'data_size + sizeof(struct kretprobe_instance)'.
> > Thus, it can be smaller than sizeof(struct kretprobe_instance)
> > while allocating memory for the kretprobe_instance.
>
> The above doesn't make sense.
>
> data_size is unsigned but it is used as
> 'data_size + sizeof(struct kretprobe_instance)'.
>
> What does that mean?
>
> What can be smaller than sizeof(struct kretprobe_instance) and why does it
> matter?

OK, what about this ?

The 'kprobe::data_size' is unsigned, thus it can not be negative.
But if user sets it enough big number (e.g. (size_t)-8), the result
of 'data_size + sizeof(struct kretprobe_instance)' becomes smaller than
sizeof(struct kretprobe_instance) or zero. In result, the kretprobe_instance
are allocated without enough memory, and kretprobe accesses outside of
allocated memory.

Thank you,

--
Masami Hiramatsu <mhiramat@kernel.org>

\
 
 \ /
  Last update: 2021-12-02 01:15    [W:0.023 / U:0.540 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site