Skip to content

Commit 8446a4d

Browse files
david-laighttehcaster
authored andcommitted
slab: kmalloc_size_roundup() must not return 0 for non-zero size
The typical use of kmalloc_size_roundup() is: ptr = kmalloc(sz = kmalloc_size_roundup(size), ...); if (!ptr) return -ENOMEM. This means it is vitally important that the returned value isn't less than the argument even if the argument is insane. In particular if kmalloc_slab() fails or the value is above (MAX_ULONG - PAGE_SIZE) zero is returned and kmalloc() will return its single zero-length buffer ZERO_SIZE_PTR. Fix this by returning the input size if the size exceeds KMALLOC_MAX_SIZE. kmalloc() will then return NULL as the size really is too big. kmalloc_slab() should not normally return NULL, unless called too early. Again, returning zero is not the correct action as it can be in some usage scenarios stored to a variable and only later cause kmalloc() return ZERO_SIZE_PTR and subsequent crashes on access. Instead we can simply stop checking the kmalloc_slab() result completely, as calling kmalloc_size_roundup() too early would then result in an immediate crash during boot and the developer noticing an issue in their code. [vbabka@suse.cz: remove kmalloc_slab() result check, tweak comments and commit log] Fixes: 05a9406 ("slab: Introduce kmalloc_size_roundup()") Signed-off-by: David Laight <david.laight@aculab.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
1 parent 46a9ea6 commit 8446a4d

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

mm/slab_common.c

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -745,24 +745,24 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags, unsigned long caller)
745745

746746
size_t kmalloc_size_roundup(size_t size)
747747
{
748-
struct kmem_cache *c;
748+
if (size && size <= KMALLOC_MAX_CACHE_SIZE) {
749+
/*
750+
* The flags don't matter since size_index is common to all.
751+
* Neither does the caller for just getting ->object_size.
752+
*/
753+
return kmalloc_slab(size, GFP_KERNEL, 0)->object_size;
754+
}
749755

750-
/* Short-circuit the 0 size case. */
751-
if (unlikely(size == 0))
752-
return 0;
753-
/* Short-circuit saturated "too-large" case. */
754-
if (unlikely(size == SIZE_MAX))
755-
return SIZE_MAX;
756756
/* Above the smaller buckets, size is a multiple of page size. */
757-
if (size > KMALLOC_MAX_CACHE_SIZE)
757+
if (size && size <= KMALLOC_MAX_SIZE)
758758
return PAGE_SIZE << get_order(size);
759759

760760
/*
761-
* The flags don't matter since size_index is common to all.
762-
* Neither does the caller for just getting ->object_size.
761+
* Return 'size' for 0 - kmalloc() returns ZERO_SIZE_PTR
762+
* and very large size - kmalloc() may fail.
763763
*/
764-
c = kmalloc_slab(size, GFP_KERNEL, 0);
765-
return c ? c->object_size : 0;
764+
return size;
765+
766766
}
767767
EXPORT_SYMBOL(kmalloc_size_roundup);
768768

0 commit comments

Comments
 (0)