2018-06-04 11:03:11

by Xiaoming Ni

Subject: [PATCH] mm: Add conditions to avoid out-of-bounds

In the function memcg_init_list_lru
if call goto fail when i == 0, will cause out-of-bounds at lru->node[i]

The same out-of-bounds access scenario exists in the functions
memcg_update_list_lru and __memcg_init_list_lru_node

Signed-off-by: nixiaoming <[email protected]>
---
mm/list_lru.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/mm/list_lru.c b/mm/list_lru.c
index fcfb6c8..ec6bdd9 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -298,6 +298,9 @@ static void __memcg_destroy_list_lru_node(struct list_lru_memcg *memcg_lrus,
{
int i;

+ if (unlikely(begin >= end))
+ return;
+
for (i = begin; i < end; i++)
kfree(memcg_lrus->lru[i]);
}
@@ -422,6 +425,8 @@ static int memcg_init_list_lru(struct list_lru *lru, bool memcg_aware)
}
return 0;
fail:
+ if (unlikely(i == 0))
+ return -ENOMEM;
for (i = i - 1; i >= 0; i--) {
if (!lru->node[i].memcg_lrus)
continue;
@@ -456,6 +461,8 @@ static int memcg_update_list_lru(struct list_lru *lru,
}
return 0;
fail:
+ if (unlikely(i == 0))
+ return -ENOMEM;
for (i = i - 1; i >= 0; i--) {
if (!lru->node[i].memcg_lrus)
continue;
--
2.10.1

2018-06-04 11:22:09

by Michal Hocko

Subject: Re: [PATCH] mm: Add conditions to avoid out-of-bounds

On Mon 04-06-18 18:37:35, nixiaoming wrote:
> In the function memcg_init_list_lru
> if call goto fail when i == 0, will cause out-of-bounds at lru->node[i]

How? All I can see is that the fail path does
for (i = i - 1; i >= 0; i--)

so it will not do anything for i=0.
--
Michal Hocko
SUSE Labs

2018-06-04 11:29:05

by Xiaoming Ni

Subject: RE: [PATCH] mm: Add conditions to avoid out-of-bounds

I'm very sorry. It was my mistake.
it won't cross the border here.

Thanks


-----Original Message-----
From: Michal Hocko [mailto:[email protected]]
Sent: Monday, June 04, 2018 7:20 PM
To: Nixiaoming <[email protected]>
Cc: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]
Subject: Re: [PATCH] mm: Add conditions to avoid out-of-bounds

On Mon 04-06-18 18:37:35, nixiaoming wrote:
> In the function memcg_init_list_lru
> if call goto fail when i == 0, will cause out-of-bounds at lru->node[i]

How? All I can see is that the fail path does
for (i = i - 1; i >= 0; i--)

so it will not do anything for i=0.
--
Michal Hocko
SUSE Labs