2022-09-26 15:48:27

by Chao Yu

Subject: [PATCH v3] mm/slub: clean up create_unique_id()

From: Chao Yu <[email protected]>

As Christophe JAILLET suggested:

In create_unique_id(),

"looks that ID_STR_LENGTH could even be reduced to 32 or 16.

The 2nd BUG_ON at the end of the function could certainly be just
removed as well or remplaced by a:
if (p > name + ID_STR_LENGTH - 1) {
kfree(name);
return -E<something>;
}
"

According to above suggestion, let's do below cleanups:
1. reduce ID_STR_LENGTH to 32, as the buffer size should be enough;
2. use WARN_ON instead of BUG_ON() and return error if check condition
is true;
3. use snprintf instead of sprintf to avoid overflow.

Link: https://lore.kernel.org/linux-mm/[email protected]/
Fixes: 81819f0fc828 ("SLUB core")
Suggested-by: Christophe JAILLET <[email protected]>
Reviewed-by: Hyeonggon Yoo <[email protected]>
Signed-off-by: Chao Yu <[email protected]>
---
v3:
- clean up codes
- fix size parameter of snprintf()
mm/slub.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mm/slub.c b/mm/slub.c
index 4b98dff9be8e..4d3ee0924533 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5890,7 +5890,7 @@ static inline struct kset *cache_kset(struct kmem_cache *s)
return slab_kset;
}

-#define ID_STR_LENGTH 64
+#define ID_STR_LENGTH 32

/* Create a unique string id for a slab cache:
*
@@ -5924,9 +5924,12 @@ static char *create_unique_id(struct kmem_cache *s)
*p++ = 'A';
if (p != name + 1)
*p++ = '-';
- p += sprintf(p, "%07u", s->size);
+ p += snprintf(p, ID_STR_LENGTH - (p - name), "%07u", s->size);

- BUG_ON(p > name + ID_STR_LENGTH - 1);
+ if (WARN_ON(p > name + ID_STR_LENGTH - 1)) {
+ kfree(name);
+ return ERR_PTR(-EINVAL);
+ }
return name;
}

--
2.36.1

2022-09-26 16:36:12

by Vlastimil Babka

Subject: Re: [PATCH v3] mm/slub: clean up create_unique_id()

On 9/26/22 16:20, Chao Yu wrote:
> From: Chao Yu <[email protected]>
>
> As Christophe JAILLET suggested:
>
> In create_unique_id(),
>
> "looks that ID_STR_LENGTH could even be reduced to 32 or 16.
>
> The 2nd BUG_ON at the end of the function could certainly be just
> removed as well or remplaced by a:
> if (p > name + ID_STR_LENGTH - 1) {
> kfree(name);
> return -E<something>;
> }
> "
>
> According to above suggestion, let's do below cleanups:
> 1. reduce ID_STR_LENGTH to 32, as the buffer size should be enough;
> 2. use WARN_ON instead of BUG_ON() and return error if check condition
> is true;
> 3. use snprintf instead of sprintf to avoid overflow.
>
> Link: https://lore.kernel.org/linux-mm/[email protected]/
> Fixes: 81819f0fc828 ("SLUB core")
> Suggested-by: Christophe JAILLET <[email protected]>
> Reviewed-by: Hyeonggon Yoo <[email protected]>
> Signed-off-by: Chao Yu <[email protected]>

Thanks, added to slab.git for-next.

> ---
> v3:
> - clean up codes
> - fix size parameter of snprintf()
> mm/slub.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 4b98dff9be8e..4d3ee0924533 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -5890,7 +5890,7 @@ static inline struct kset *cache_kset(struct kmem_cache *s)
> return slab_kset;
> }
>
> -#define ID_STR_LENGTH 64
> +#define ID_STR_LENGTH 32
>
> /* Create a unique string id for a slab cache:
> *
> @@ -5924,9 +5924,12 @@ static char *create_unique_id(struct kmem_cache *s)
> *p++ = 'A';
> if (p != name + 1)
> *p++ = '-';
> - p += sprintf(p, "%07u", s->size);
> + p += snprintf(p, ID_STR_LENGTH - (p - name), "%07u", s->size);
>
> - BUG_ON(p > name + ID_STR_LENGTH - 1);
> + if (WARN_ON(p > name + ID_STR_LENGTH - 1)) {
> + kfree(name);
> + return ERR_PTR(-EINVAL);
> + }
> return name;
> }
>