From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 975C9C433E0 for ; Mon, 25 Jan 2021 15:45:00 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 30A12229C5 for ; Mon, 25 Jan 2021 15:45:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 30A12229C5 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A4D678D000A; Mon, 25 Jan 2021 10:44:59 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9FEFF8D0001; Mon, 25 Jan 2021 10:44:59 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8C6B28D000A; Mon, 25 Jan 2021 10:44:59 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0252.hostedemail.com [216.40.44.252]) by kanga.kvack.org (Postfix) with ESMTP id 77DD98D0001 for ; Mon, 25 Jan 2021 10:44:59 -0500 (EST) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 28C6A180ACF1F for ; Mon, 25 Jan 2021 15:44:59 +0000 (UTC) X-FDA: 77744720718.09.road78_311326e27586 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin09.hostedemail.com (Postfix) with ESMTP id 0A50F180AD811 for ; Mon, 25 Jan 2021 15:44:59 +0000 (UTC) X-HE-Tag: road78_311326e27586 X-Filterd-Recvd-Size: 3970 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf16.hostedemail.com (Postfix) with ESMTP for ; Mon, 25 Jan 2021 15:44:58 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1611589497; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=5qKvzTrNaxhJI5NYBVCCsxPOcqjU7ikjK7XG0JcKFTI=; b=Ytu82Grx+6dQ7yjn9CUMaoEZQL/dNnv1+dm+XFnG79S5pHZmk4FbCiDuiLwgMokfGFmv9T SaM/ICxT6QDdUq+CxkhzU3Fgjgl9XDvxs0xZkX1jLhpM8Bi1YVWLVnr5W24mvFl0ghqr8X /UZ2O9lObu1+ZeH0RLQo7ZCBU7YGiAg= Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id DE16FAD18; Mon, 25 Jan 2021 15:44:56 +0000 (UTC) Date: Mon, 25 Jan 2021 16:44:55 +0100 From: Michal Hocko To: Tetsuo Handa Cc: Andrew Morton , Alexander Viro , linux-mm@kvack.org, Sabyrzhan Tasbolatov Subject: Re: [PATCH v2] mm: memdup_user*() should use same gfp flags Message-ID: <20210125154455.GO827@dhcp22.suse.cz> References: <20210120041843.5090-1-penguin-kernel@I-love.SAKURA.ne.jp> <20210120103436.11830-1-penguin-kernel@I-love.SAKURA.ne.jp> <20210121173538.166e8b27408d4525360fbb70@linux-foundation.org> <5346de21-a404-8476-f2a3-c98c191a2ef9@i-love.sakura.ne.jp> <20210125133244.GK827@dhcp22.suse.cz> <4ca702ae-9a67-fb4b-adcd-6668d43b7697@i-love.sakura.ne.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4ca702ae-9a67-fb4b-adcd-6668d43b7697@i-love.sakura.ne.jp> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon 25-01-21 23:20:41, Tetsuo Handa wrote: > On 2021/01/25 22:32, Michal Hocko wrote: > > On Fri 22-01-21 19:47:42, Tetsuo Handa wrote: > >> On 2021/01/22 10:35, Andrew Morton wrote: > >>> On Wed, 20 Jan 2021 19:34:36 +0900 Tetsuo Handa wrote: > >>> > >>>> syzbot is reporting that memdup_user_nul() which receives user-controlled > >>>> size (which can be up to (INT_MAX & PAGE_MASK)) via vfs_write() will hit > >>>> order >= MAX_ORDER path [1]. > > > > That is nasty! > > That's because -EFAULT will not be detected before memory allocation succeeds. > Fuzzer is passing huge size without corresponding valid buffer. > > syscall(__NR_write, r[0], 0x200000c0ul, 0x200000cbul); > > > > >>>> Let's add __GFP_NOWARN to memdup_user_nul() as with commit 6c8fcc096be9d02f > >>>> ("mm: don't let userspace spam allocations warnings"). Also use GFP_USER as > >>>> with commit 6c2c97a24f096e32 ("memdup_user(): switch to GFP_USER"). > > > > No, this is papering over a more troubling underlying problem. Userspace > > shouldn't be able to trigger an aribitrary higher order allocations. > > That requires inserting max size checking before calling memdup_user_nul(). > Oh, scattering around such checking is not nice. Add max length argument > into memdup_user_nul() like strndup_user() ? Or simply fallback to the vmalloc based memdump* if the size is larger than the PAGE_SIZE. It seems that the existing API is much more complex than necessary. [...] > > I do not think we have anything better than the above. GFP_USER is > > indeed used for userspace controlable allocations. So they can be a > > subject to a more strict cpu policy. memdup_user_nul looks like a good > > fit for GFP_USER to me. memdup_user and other variant already does this. > > > > Hmm, Sabyrzhan already proposed a patch that adds size check to the caller, but it seems > that that patch missed smk_write_ambient()/smk_write_onlycap()/smk_write_unconfined() etc. > Oh, bug-prone approach. Why not handle at memdup_user_nul() side? I am sorry I do not follow. -- Michal Hocko SUSE Labs