Re: [git pull] uaccess-related bits of vfs.git

[Linus Torvalds]

On Sat, May 13, 2017 at 1:37 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>
> That's a valid point and it might apply to memdup_user() callers out there.
> Potential variants:
>         * add an explicit upper bound on the size and turn that into
> memdup_user() (and check that all memdup_user() callers are bounded).
>         * have memdup_user() itself pass __GFP_NOWARN.
>         * add kvmemdup_user() that would use kvmalloc() (with its callers
> expected to use kvfree()); see who else might benefit from conversion.

All of the above sound reasonable.

I wouldn't change the existing "memdup_user()" interface itself, but
if there really are users that can validly pass in a maxbyte value,
why not add a new helper:

  void *memdup_user_limit(userptr, nmember, nsize, maxsize);

and then have

  #define memdup_user(ptr,size) memdup_user_limit(ptr, size, 1, -1)

or something. I definitely see a couple of memdup_user() people who do
that "num*size" multiplication by hand, and it's very easy to get
wrong and have an overflow.

And for a kvmalloc/kvfree() interface, you *definitely* want that
maxsize thing, since it absolutely needs an upper limit.

             Linus