Re: [git pull] uaccess-related bits of vfs.git

From: Linus Torvalds
Date: Sat May 13 2017 - 16:52:48 EST

On Sat, May 13, 2017 at 1:37 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
> That's a valid point and it might apply to memdup_user() callers out there.
> Potential variants:
> * add an explicit upper bound on the size and turn that into
> memdup_user() (and check that all memdup_user() callers are bounded).
> * have memdup_user() itself pass __GFP_NOWARN.
> * add kvmemdup_user() that would use kvmalloc() (with its callers
> expected to use kvfree()); see who else might benefit from conversion.

All of the above sound reasonable.

I wouldn't change the existing "memdup_user()" interface itself, but
if there really are users that can validly pass in a maxbyte value,
why not add a new helper:

void *memdup_user_limit(userptr, nmember, nsize, maxsize);

and then have

#define memdup_user(ptr,size) memdup_user_limit(ptr, size, 1, -1)

or something. I definitely see a couple of memdup_user() people who do
that "num*size" multiplication by hand, and it's very easy to get
wrong and have an overflow.

And for a kvmalloc/kvfree() interface, you *definitely* want that
maxsize thing, since it absolutely needs an upper limit.