Page MenuHomeFreeBSD

kmem: Check for overflows when rounding up allocation sizes
Needs ReviewPublic

Authored by markj on Jul 24 2024, 9:31 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Nov 27, 10:04 AM
Unknown Object (File)
Sun, Nov 16, 12:44 PM
Unknown Object (File)
Oct 30 2025, 11:15 AM
Unknown Object (File)
Oct 25 2025, 5:49 AM
Unknown Object (File)
Oct 24 2025, 9:27 PM
Unknown Object (File)
Oct 24 2025, 12:06 PM
Unknown Object (File)
Oct 24 2025, 12:23 AM
Unknown Object (File)
Oct 23 2025, 6:18 PM
Subscribers

Details

Reviewers
dougm
Summary

In the past we've had bugs where lack of argument validation allowed a
user-controlled size to be passed to kmem_malloc() and friends.
Explicitly check before rounding up the allocation size to the page size.

This requires a bit of reorganization for kmem_alloc_san(), which wants
both the requested size and the true allocation size.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 58809
Build 55696: arc lint + arc unit

Event Timeline

markj requested review of this revision.Jul 24 2024, 9:31 PM
sys/vm/vm_kern.c
332

addr could be NULL. Add a check.

432

add addr != NULL check.

529

Add addr != NULL check.

alc added inline comments.
sys/vm/vm_kern.c
165

This rounding operation has always been redundant, since vmem_xalloc() also rounds. I would suggest moving the overflow test into vmem_xalloc().

188–191

vmem_xfree() already asserts that the rounded, passed-in size matches the boundary tag, which basically accomplishes the same.