* PROBLEM: unchecked returns from kmalloc() in linux-2.6.10-rc2
@ 2004-12-07 18:20 Katrina Tsipenyuk
2004-12-07 19:28 ` Jesper Juhl
0 siblings, 1 reply; 2+ messages in thread
From: Katrina Tsipenyuk @ 2004-12-07 18:20 UTC (permalink / raw)
To: linux-kernel
Linux developers,
We -- Fortify Software engineering team -- have looked at
linux-2.6.10-rc2 and performed static analysis of the code.
We have discovered several instances of the same potential
vulnerability in the kernel code. Because these issues have
been discovered at compile time rather than run time, our
bug report does not follow the format proposed here
http://www.kernel.org/pub/linux/docs/lkml/reporting-bugs.html
completely.
Below we provide a more detailed description of the issues.
[1.] We have found several instances of unchecked return values from
kmalloc().
[2.] Checking whether memory allocation succeeded is important,
especially in the kernel code. Failure might cause a kernel crash.
We have noticed the same problem in 3 different places. Considering the
fact that in other cases, the return from kmalloc() is validated before
being use, these are definite bugs.
1) kernel/module.c:
...
331: static int percpu_modinit(void)
332: {
333: pcpu_num_used = 2;
334: pcpu_num_allocated = 2;
335: pcpu_size = kmalloc(sizeof(pcpu_size[0]) *
pcpu_num_allocated,
336: GFP_KERNEL);
337: /* Static in-kernel percpu data (used). */
338: pcpu_size[0] = -ALIGN(__per_cpu_end-__per_cpu_start,
SMP_CACHE_BYTES);
339: /* Free room. */
340: pcpu_size[1] = PERCPU_ENOUGH_ROOM + pcpu_size[0];
341: if (pcpu_size[1] < 0) {
342: printk(KERN_ERR "No per-cpu room for modules.\n");
343: pcpu_num_used = 1;
344: }
345:
346: return 0;
347: }
...
Here, memory is allocated for pcpu_size on line 335, and then
pcpu_size[0] is accessed on line 338 without prior validation of memory
allocation.
Note that in the same file -- kernel/module.c -- there are several other
uses of kmalloc() -- lines 221, 419, 779, 974, 1055, 1546 -- where
appropriate checks are made, and appropriate actions are taken in case
of failure, e.g. an error code is returned.
2,3) mm/slab.c:
...
802: /* 4) Replace the bootstrap head arrays */
803: {
804: void * ptr;
805:
806: ptr = kmalloc(sizeof(struct arraycache_init),
GFP_KERNEL);
807: local_irq_disable();
808: BUG_ON(ac_data(&cache_cache) !=
&initarray_cache.cache);
809: memcpy(ptr, ac_data(&cache_cache), sizeof(struct
arraycache_init));
810: cache_cache.array[smp_processor_id()] = ptr;
811: local_irq_enable();
812:
813: ptr = kmalloc(sizeof(struct arraycache_init),
GFP_KERNEL);
814: local_irq_disable();
815: BUG_ON(ac_data(malloc_sizes[0].cs_cachep) !=
&initarray_generic.cache);
816: memcpy(ptr, ac_data(malloc_sizes[0].cs_cachep),
817: sizeof(struct arraycache_init));
818:
malloc_sizes[0].cs_cachep->array[smp_processor_id()] = ptr;
819: local_irq_enable();
820: }
...
Here, memory is allocated for ptr on lines 806 and 813, and then ptr is
used in memcpy() on lines 809 and 816, respectively, without prior
validation of memory allocation.
Note that in the same file -- mm/slab.c -- there are several other uses
of kmalloc() -- lines 653, 2461, 2526 -- where appropriate checks are
made, and appropriate actions are taken in case of failure, e.g. NULL is
returned.
[3.] Fixing the above issues should be trivial and quick. One just needs
to perform success / failure checks on the return from kmalloc() and
take appropriate actions depending on the situation: return an error
code, return NULL, panic, etc. One could even refer to other occurrences
of kmalloc() to see what actions should be taken in various cases. Some
line numbers are provided above.
Sincerely,
Fortify Software Team
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: PROBLEM: unchecked returns from kmalloc() in linux-2.6.10-rc2
2004-12-07 18:20 PROBLEM: unchecked returns from kmalloc() in linux-2.6.10-rc2 Katrina Tsipenyuk
@ 2004-12-07 19:28 ` Jesper Juhl
0 siblings, 0 replies; 2+ messages in thread
From: Jesper Juhl @ 2004-12-07 19:28 UTC (permalink / raw)
To: katrina; +Cc: Katrina Tsipenyuk, linux-kernel
On Tue, 7 Dec 2004, Katrina Tsipenyuk wrote:
> Linux developers,
>
> We -- Fortify Software engineering team -- have looked at
> linux-2.6.10-rc2 and performed static analysis of the code.
> We have discovered several instances of the same potential
> vulnerability in the kernel code.
[...]
> [1.] We have found several instances of unchecked return values from
> kmalloc().
[...]
Unless someone else beats me to it I'll take a stab at fixing these.
Thank you for the report. Expect patches shortly (hopefully :)
--
Jesper Juhl <juhl-lkml@dif.dk>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-12-07 19:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2004-12-07 18:20 PROBLEM: unchecked returns from kmalloc() in linux-2.6.10-rc2 Katrina Tsipenyuk
2004-12-07 19:28 ` Jesper Juhl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome