Received-SPF: pass (google.com: domain of linux-kernel+bounces-126071-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Sun, 31 Mar 2024 15:30:28 +0200
From: Erick Archer <erick.archer@outlook.com>
To: Ingo Molnar <mingo@kernel.org>
Cc: Erick Archer <erick.archer@outlook.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Namhyung Kim <namhyung@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Borislav Petkov <bp@alien8.de>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Mark Rutland <mark.rutland@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Jiri Olsa <jolsa@kernel.org>, Ian Rogers <irogers@google.com>,
	Adrian Hunter <adrian.hunter@intel.com>,
	"H. Peter Anvin" <hpa@zytor.com>, Kees Cook <keescook@chromium.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>, x86@kernel.org,
	linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-hardening@vger.kernel.org
Subject: Re: [PATCH v2] perf/x86/amd/uncore: Use kcalloc*() instead of
 kzalloc*()
Message-ID:
 <AS8PR02MB72372CBD73E905472351EFE88B382@AS8PR02MB7237.eurprd02.prod.outlook.com>
References: <AS8PR02MB7237A07D73D6D15EBF72FD8D8B392@AS8PR02MB7237.eurprd02.prod.outlook.com>
 <Zgh/+xSyOil37H1F@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Zgh/+xSyOil37H1F@gmail.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AS8PR02MB7237:EE_|PAVPR02MB9890:EE_
X-MS-Office365-Filtering-Correlation-Id: c0ec3ab6-4d49-4d1d-bcd9-08dc5186c231
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	ywrfIqpSbd9KRSzHRPly6orNFz1xi64nfkeW83R1S9oRt0IQZxmdwdkXF2Ju3qLNU4NpZ6cLLSoH/AEhfv+aIyZLI2AbWwB4zTjUCwm2XSlOey/DvRK7KhbgH/9cJlOBVylGWrHmu2VbuNFJpDsvkEic6VyregYMTEoI/0RJKWCOb7+Ws5Oh0mzU7E4Gm6fM+9sMBkec4zfIrDuvC8lK0CfZFjyuXs5p8R43EsnnhbF+suP3DeWnEtDxdmcrFEAtX45H6ite8gbdJTQ7+Zwah1nhkG3qVDWomhTyH56uTz1kQ2Uu5pQQpHSjph2m3tAFl828gfFFYaNbvyKfhPWCv/9AQw7UrUTwNFwiKwYKn+efgiqvm0FB2AM0gI0HlEtdsLASn03OeSQ/4Q9Z2naOsFXd6d5AOYUcZZg3ACs02Fpnvrw/BCzZyNFIAU8V2wTSXqdqyeo8aU3zhXVUOedPZ2qQdQkfGE3Wv2gH1J22GxYl9MFKb+DiP9pXVsJ3HE79r3yfQeJTK/hE0ZpCTHW0j9RL4oBgWss8lctLXLjt8c2O9pmB5JWg4QYYh800CZVRISTiIcun5REk+WXl8XnZYWf6MfsPBPnP8MS1JJxqHUxoyBbCdijcn5Ucdi09KQjGRZjX5r6jEYvoVD6lV3pDt/V3QSVmdng9ZysKh/+HnCwUFyxT2rTgmHzYHxsGyTwoX3HlFq4H3qZykF7AtwTa+Q==
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?G0f368EB0wcsP4l/IkpIw8n1IJjnEO8N/YeQThAFOCw+FsyC+D6zV46I6S5W?=
 =?us-ascii?Q?J65dz0mpRtVXyUH0UM6V5hH5MWBmRwHLXTPHk8XoFa42Na8ZT1Ymqj09taK8?=
 =?us-ascii?Q?NI5McPhPLV0bXygVdzSYN3xpqj87CZgGYeMpI+KYGe6m1KIbWSw/ulKxgmrp?=
 =?us-ascii?Q?VJjgfo7LLUHhJDIN2Okxh9EFZ5HPY+5Rcl0uO3L0FrcXt3+ZjCNGj1jmKVWZ?=
 =?us-ascii?Q?jx6el7RPWyrmyLnfRxnzTZRjWn6I3uInO5+aS7kjHgP5+U28WotZ60c9nYw+?=
 =?us-ascii?Q?V9BrwlHCLdC8OpeooHrsCgxNOhDTHyM8dJ6TsnSRzHaEqz6hbVVJkMG/4mAN?=
 =?us-ascii?Q?hzdCvpYPNDrV88+rChp3oIFJ+IrYLGiJYyMNnfMmIIWzqgULuVUpokQa6BgR?=
 =?us-ascii?Q?B2Y5weJLjGC2qBwQ2XPeeo6sKwoxWNO2B7ljA3Z9cLhNi7r5OR/xp91AFNHx?=
 =?us-ascii?Q?ieAnceuBRtbuvJJsQI88m0g4KBpyXZKUouKIXGRaatBVfFb1LcRJzixk71Qu?=
 =?us-ascii?Q?EMGHvLgjK1VUAdNWrQuarRAP7Xy/93Fe/nFNJJGMZRNPhvRH+PJWU3QT9y7v?=
 =?us-ascii?Q?WZDMSz6wYzwdetyr8B3RIyZNh6V6E9wxGMKSG5xJ/7np7lpjDXz+dup7KwdL?=
 =?us-ascii?Q?ojDZoEzMnkrDoKcJiZHHvKTO34157EIg31mQ2OXgrgiwz39CGxp3B+72lTSP?=
 =?us-ascii?Q?7Bb55Gu8HxqErBjZnUXp3PYZxXU4z3nhI7yezk4bUlQYH/JkCHy726Dm86L5?=
 =?us-ascii?Q?P4Y3jAas0+J/sHOEuVYqer+E7HMSgMAEFiAgi9ar2082Oo6QYYH3KWstGRP5?=
 =?us-ascii?Q?06Sye0Cfb5AuAwMw+HqzWiRf4VkqrGItBy1L+YXJe+Ez0VpC32dmkrY3vvXW?=
 =?us-ascii?Q?4gFfv3h2epN7IbQ5FQP/euONGMkRjqLzF1BuO9x0CaYsM9xrcMZJOEfPg6hW?=
 =?us-ascii?Q?qPExtWidp9mEao8S2/jlchGwPRhqMZvpss6g76HP2K6TOsoqeIgUqoIiRL+m?=
 =?us-ascii?Q?Fwx2lPjZO0WDv5ftosrQonGgBVM2nNR87vFGQlRRnEvJRyITSmCc/J7dcIbg?=
 =?us-ascii?Q?bFlGYBaaMlM7R/OJ0BDdTHNOy+hLt+smXEBt9sLA5Lehlg21O7hI8gbSE992?=
 =?us-ascii?Q?RnM+BB4MAjxzLJ2HsVwl/cyveQhUiIitTG6NkwW1ge0Es+NEjCdp9YKPX94s?=
 =?us-ascii?Q?vRQwI0sQuXb5JzKbc6OUJrfZeBp4Ige9fO5UMF9YyMFkfCK7OuHavDHK/ZNq?=
 =?us-ascii?Q?CZsIIKwLGDRTvxFmoYV6?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c0ec3ab6-4d49-4d1d-bcd9-08dc5186c231
X-MS-Exchange-CrossTenant-AuthSource: AS8PR02MB7237.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Mar 2024 13:30:42.3058
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
	00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR02MB9890

Hi Ingo,

On Sat, Mar 30, 2024 at 10:11:23PM +0100, Ingo Molnar wrote:
> 
> * Erick Archer <erick.archer@outlook.com> wrote:
> 
> > As noted in the "Deprecated Interfaces, Language Features, Attributes,
> > and Conventions" documentation [1], size calculations (especially
> > multiplication) should not be performed in memory allocator (or similar)
> > function arguments due to the risk of them overflowing. This could lead
> > to values wrapping around and a smaller allocation being made than the
> > caller was expecting. Using those allocations could lead to linear
> > overflows of heap memory and other misbehaviors.
> > 
> > So, use the purpose specific kcalloc*() function instead of the argument
> > size * count in the kzalloc*() function.
> > 
> > [1] https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments
> > 
> > Link: https://github.com/KSPP/linux/issues/162
> > Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> > Signed-off-by: Erick Archer <erick.archer@outlook.com>
> > ---
> > Changes in v2:
> > - Add the "Reviewed-by:" tag.
> > - Rebase against linux-next.
> > 
> > Previous versions:
> > v1 -> https://lore.kernel.org/linux-hardening/20240116125813.3754-1-erick.archer@gmx.com/
> > 
> > Hi everyone,
> > 
> > This patch seems to be lost. Gustavo reviewed it on January 16, 2024
> > but the patch has not been applied since.
> > 
> > Thanks,
> > Erick
> > ---
> >  arch/x86/events/amd/uncore.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
> > index 4ccb8fa483e6..61c0a2114183 100644
> > --- a/arch/x86/events/amd/uncore.c
> > +++ b/arch/x86/events/amd/uncore.c
> > @@ -479,8 +479,8 @@ static int amd_uncore_ctx_init(struct amd_uncore *uncore, unsigned int cpu)
> >  				goto fail;
> >  
> >  			curr->cpu = cpu;
> > -			curr->events = kzalloc_node(sizeof(*curr->events) *
> > -						    pmu->num_counters,
> > +			curr->events = kcalloc_node(pmu->num_counters,
> > +						    sizeof(*curr->events),
> >  						    GFP_KERNEL, node);
> >  			if (!curr->events) {
> >  				kfree(curr);
> > @@ -928,7 +928,7 @@ int amd_uncore_umc_ctx_init(struct amd_uncore *uncore, unsigned int cpu)
> >  		uncore->num_pmus += group_num_pmus[gid];
> >  	}
> >  
> > -	uncore->pmus = kzalloc(sizeof(*uncore->pmus) * uncore->num_pmus,
> > +	uncore->pmus = kcalloc(uncore->num_pmus, sizeof(*uncore->pmus),
> >  			       GFP_KERNEL);
> >  	if (!uncore->pmus) {
> >  		uncore->num_pmus = 0;
> 
> This change is nonsense, kzalloc() is a perfectly usable interface, and 
> none of the arguments are user-controlled, so I don't see how there 
> could be a real overflow bug here.

Yes, you are right. This scenario is obviously safe, but this is an
effort to get rid of all multiplications from allocations functions
in the kernel. Surely, the commit message is scarier than it really
is in reality.

If you prefer I can send a v3 with the following commit message in
order to better explain the change.

[start of commit message] -----------------------------------------
This is an effort to get rid of all multiplications from allocation
functions in order to prevent integer overflows [1].

Here the multiplication is obviously safe. However, using kcalloc*()
is more appropriate [2] and improves readability. This patch has no
effect on runtime behavior.

Link: https://github.com/KSPP/linux/issues/162 [1]
Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [2]
[end of commit message] -------------------------------------------

Best regards,
Erick

> Thanks,
> 
> 	Ingo