Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754795AbbLAKrj (ORCPT ); Tue, 1 Dec 2015 05:47:39 -0500 Received: from smtp-out4.electric.net ([192.162.216.186]:64944 "EHLO smtp-out4.electric.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752406AbbLAKrh convert rfc822-to-8bit (ORCPT ); Tue, 1 Dec 2015 05:47:37 -0500 From: David Laight To: "'Marcelo Ricardo Leitner'" , "netdev@vger.kernel.org" CC: "linux-sctp@vger.kernel.org" , Vlad Yasevich , Neil Horman , "daniel@iogearbox.net" , "linux-kernel@vger.kernel.org" , "davem@davemloft.net" , "syzkaller@googlegroups.com" , "dvyukov@google.com" , "kcc@google.com" , "glider@google.com" , "sasha.levin@oracle.com" , "edumazet@google.com" Subject: RE: [PATCH] sctp: use GFP_USER for user-controlled kmalloc Thread-Topic: [PATCH] sctp: use GFP_USER for user-controlled kmalloc Thread-Index: AQHRK4zaIG2cZ8vLak6URqs/abVyB56183Tg Date: Tue, 1 Dec 2015 10:46:11 +0000 Message-ID: <063D6719AE5E284EB5DD2968C1650D6D1CBDF85D@AcuExch.aculab.com> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.202.99.200] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-Outbound-IP: 213.249.233.130 X-Env-From: David.Laight@ACULAB.COM X-PolicySMART: 3396946, 3397078 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 824 Lines: 20 From: Marcelo Ricardo Leitner > Sent: 30 November 2015 16:33 > Dmitry Vyukov reported that the user could trigger a kernel warning by > using a large len value for getsockopt SCTP_GET_LOCAL_ADDRS, as that > value directly affects the value used as a kmalloc() parameter. > > This patch thus switches the allocation flags from all user-controllable > kmalloc size to GFP_USER to put some more restrictions on it and also > disables the warn, as they are not necessary. ISTM that the code should put some 'sanity limit' on that size before allocating the kernel buffer. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/