Re: [PATCH] selinux: Add __GFP_NOWARN to allocation at str_read()
From: Michal Hocko
Date: Thu Sep 13 2018 - 07:11:40 EST
On Thu 13-09-18 09:12:04, peter enderborg wrote:
> On 09/13/2018 08:26 AM, Tetsuo Handa wrote:
> > On 2018/09/13 12:02, Paul Moore wrote:
> >> On Fri, Sep 7, 2018 at 12:43 PM Tetsuo Handa
> >> <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote:
> >>> syzbot is hitting warning at str_read()  because len parameter can
> >>> become larger than KMALLOC_MAX_SIZE. We don't need to emit warning for
> >>> this case.
> >>>  https://syzkaller.appspot.com/bug?id=7f2f5aad79ea8663c296a2eedb81978401a908f0
> >>> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> >>> Reported-by: syzbot <syzbot+ac488b9811036cea7ea0@xxxxxxxxxxxxxxxxxxxxxxxxx>
> >>> ---
> >>> security/selinux/ss/policydb.c | 2 +-
> >>> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> >>> index e9394e7..f4eadd3 100644
> >>> --- a/security/selinux/ss/policydb.c
> >>> +++ b/security/selinux/ss/policydb.c
> >>> @@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
> >>> if ((len == 0) || (len == (u32)-1))
> >>> return -EINVAL;
> >>> - str = kmalloc(len + 1, flags);
> >>> + str = kmalloc(len + 1, flags | __GFP_NOWARN);
> >>> if (!str)
> >>> return -ENOMEM;
> >> Thanks for the patch.
> >> My eyes are starting to glaze over a bit chasing down all of the
> >> different kmalloc() code paths trying to ensure that this always does
> >> the right thing based on size of the allocation and the different slab
> >> allocators ... are we sure that this will always return NULL when (len
> >> + 1) is greater than KMALLOC_MAX_SIZE for the different slab allocator
> >> configurations?
> > Yes, for (len + 1) cannot become 0 (which causes kmalloc() to return
> > ZERO_SIZE_PTR) due to (len == (u32)-1) check above.
> > The only concern would be whether you want allocation failure messages.
> > I assumed you don't need it because we are returning -ENOMEM to the caller.
> Would it not be better with
> char *str;
> if ((len == 0) || (len == (u32)-1) || (len >= KMALLOC_MAX_SIZE))
> return -EINVAL;
> str = kmalloc(len + 1, flags);
> if (!str)
> return -ENOMEM;
I strongly suspect that you want kvmalloc rather than kmalloc here. The
larger the request the more likely is the allocation to fail.
I am not familiar with the code but I assume this is a root only
interface so we don't have to worry about nasty users scenario.