[PATCH v2] drivers/gpu/vga: allocate vga_arb_write() buffer on stack

[Daniel Vetter]

On Mon, Nov 14, 2016 at 10:11:47AM +0100, Dmitry Vyukov wrote:
> On Fri, Oct 14, 2016 at 3:22 PM, Dmitry Vyukov <dvyukov at google.com> wrote:
> > Size of kmalloc() in vga_arb_write() is controlled by user.
> > Too large kmalloc() size triggers WARNING message on console.
> > Allocate the buffer on stack to avoid the WARNING.
> > The string must be small (e.g "target PCI:domain:bus:dev.fn").
> >
> > Signed-off-by: Dmitry Vyukov <dvyukov at google.com>
> > Reviewed-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
> > Cc: Dave Airlie <airlied at gmail.com>
> > Cc: Ville Syrjälä <ville.syrjala at linux.intel.com>
> > Cc: dri-devel at lists.freedesktop.org
> > Cc: syzkaller at googlegroups.com
> 
> Ping, this is still not merged.
> David, please take this to dri tree.

It's applied to drm-misc already.
-Daniel

> 
> 
> > ---
> >
> > Changes since v1:
> >  - removed another kfree(kbuf)
> >
> > I've sent a patch that adds __GFP_NOWARN to the kmalloc a while ago:
> > https://groups.google.com/forum/#!msg/syzkaller/navdAwe4iCo/mZDhODsnAAAJ
> >
> > Ville suggested to allocate the buffer on stack as it must be small:
> >
> > "From the looks of things the longest command could be the
> > "target PCI:domain:bus:dev.fn" thing. Even assuming something silly like
> > having 10 characters for each domain,bus,dev,fn that would still be only
> > 55 bytes. So based on that even something like 64 bytes should be more
> > than enough AFAICS. "
> >
> > Example WARNING:
> >
> > WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999
> > __alloc_pages_nodemask+0x7d2/0x1760()
> > Modules linked in:
> > CPU: 2 PID: 29322 Comm: syz-executor Tainted: G    B  4.5.0-rc1+ #283
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> >  00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000
> >  ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9
> >  ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0
> > Call Trace:
> >  [<     inline     >] __dump_stack lib/dump_stack.c:15
> >  [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> >  [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
> >  [<ffffffff8134ff29>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
> >  [<     inline     >] __alloc_pages_slowpath mm/page_alloc.c:2999
> >  [<ffffffff8166de32>] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253
> >  [<ffffffff81745c99>] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090
> >  [<     inline     >] alloc_pages include/linux/gfp.h:459
> >  [<ffffffff81669bb6>] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433
> >  [<ffffffff816c20af>] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008
> >  [<ffffffff816c212f>] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019
> >  [<     inline     >] kmalloc_large include/linux/slab.h:395
> >  [<ffffffff81756b24>] __kmalloc+0x2f4/0x340 mm/slub.c:3557
> >  [<     inline     >] kmalloc include/linux/slab.h:468
> >  [<ffffffff832c65a4>] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926
> >  [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719
> >  [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849
> >  [<ffffffff817ad8b6>] vfs_writev+0x86/0xc0 fs/read_write.c:886
> >  [<     inline     >] SYSC_writev fs/read_write.c:919
> >  [<ffffffff817b0a21>] SyS_writev+0x111/0x2b0 fs/read_write.c:911
> >  [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a
> > arch/x86/entry/entry_64.S:185
> > ---
> >  drivers/gpu/vga/vgaarb.c | 15 ++++-----------
> >  1 file changed, 4 insertions(+), 11 deletions(-)
> >
> > diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
> > index 1887f19..77657a8 100644
> > --- a/drivers/gpu/vga/vgaarb.c
> > +++ b/drivers/gpu/vga/vgaarb.c
> > @@ -1022,21 +1022,16 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf,
> >
> >         unsigned int io_state;
> >
> > -       char *kbuf, *curr_pos;
> > +       char kbuf[64], *curr_pos;
> >         size_t remaining = count;
> >
> >         int ret_val;
> >         int i;
> >
> > -
> > -       kbuf = kmalloc(count + 1, GFP_KERNEL);
> > -       if (!kbuf)
> > -               return -ENOMEM;
> > -
> > -       if (copy_from_user(kbuf, buf, count)) {
> > -               kfree(kbuf);
> > +       if (count >= sizeof(kbuf))
> > +               return -EINVAL;
> > +       if (copy_from_user(kbuf, buf, count))
> >                 return -EFAULT;
> > -       }
> >         curr_pos = kbuf;
> >         kbuf[count] = '\0';     /* Just to make sure... */
> >
> > @@ -1259,11 +1254,9 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf,
> >                 goto done;
> >         }
> >         /* If we got here, the message written is not part of the protocol! */
> > -       kfree(kbuf);
> >         return -EPROTO;
> >
> >  done:
> > -       kfree(kbuf);
> >         return ret_val;
> >  }
> >
> > --
> > 2.8.0.rc3.226.g39d4020
> >
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch