Re: [PATCH] mm/util: make memdup_user_nul() similar to memdup_user()

[Kees Cook <kees@kernel.org>]

On Sat, Dec 21, 2024 at 04:47:29PM +0900, Tetsuo Handa wrote:
> Since the string data to copy from userspace is likely less than PAGE_SIZE
> bytes, replace GFP_KERNEL with GFP_USER like commit 6c2c97a24f09
> ("memdup_user(): switch to GFP_USER") does and add __GFP_NOWARN like commit
> 6c8fcc096be9 ("mm: don't let userspace spam allocations warnings") does.
> Also, use dedicated slab buckets like commit d73778e4b867 ("mm/util: Use
> dedicated slab buckets for memdup_user()") does.
> 
> Reported-by: syzbot+7e12e97b36154c54414b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7e12e97b36154c54414b
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Thanks for this! Yes, please. With the commit log updated to answer
akpm's questions:

Acked-by: Kees Cook <kees@kernel.org>

-Kees

> ---
>  mm/util.c | 7 +------
>  1 file changed, 1 insertion(+), 6 deletions(-)
> 
> diff --git a/mm/util.c b/mm/util.c
> index c1c3b06ab4f9..60aa40f612b8 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -297,12 +297,7 @@ void *memdup_user_nul(const void __user *src, size_t len)
>  {
>  	char *p;
>  
> -	/*
> -	 * Always use GFP_KERNEL, since copy_from_user() can sleep and
> -	 * cause pagefault, which makes it pointless to use GFP_NOFS
> -	 * or GFP_ATOMIC.
> -	 */
> -	p = kmalloc_track_caller(len + 1, GFP_KERNEL);
> +	p = kmem_buckets_alloc_track_caller(user_buckets, len + 1, GFP_USER | __GFP_NOWARN);
>  	if (!p)
>  		return ERR_PTR(-ENOMEM);
>  
> -- 
> 2.43.5

-- 
Kees Cook