From: Danilo Krummrich <dakr@redhat.com>
To: ojeda@kernel.org, alex.gaynor@gmail.com, wedsonaf@gmail.com,
boqun.feng@gmail.com, gary@garyguo.net, bjorn3_gh@protonmail.com,
benno.lossin@proton.me, a.hindborg@samsung.com,
aliceryhl@google.com
Cc: rust-for-linux@vger.kernel.org, Danilo Krummrich <dakr@redhat.com>
Subject: [PATCH v2] rust: alloc: fix dangling pointer in VecExt<T>::reserve()
Date: Tue, 30 Apr 2024 14:13:19 +0200 [thread overview]
Message-ID: <20240430121322.2660-1-dakr@redhat.com> (raw)
Currently, a Vec<T>'s ptr value, after calling Vec<T>::new(), is
initialized to Unique::dangling(). Hence, in VecExt<T>::reserve(), we're
passing a dangling pointer (instead of NULL) to krealloc() whenever a
new Vec<T> is created through VecExt<T> extension functions.
This only works as long as align_of::<T>(), used by Unique::dangling() to
derive the dangling pointer, resolves to a value between 0x0 and
ZERO_SIZE_PTR (0x10) and krealloc() hence treats it the same as a NULL
pointer however.
This isn't a case we should rely on, since there may be types whose
alignment may exceed the range still covered by krealloc(), plus other
kernel allocators are not as tolerant either.
Instead, pass a real NULL pointer to krealloc_aligned() if Vec<T>'s
capacity is zero.
Fixes: 5ab560ce12ed ("rust: alloc: update `VecExt` to take allocation flags")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
---
Changes in v2:
- correct the description of the pointer value produced by
Unique::dangling() (Alice)
- add RB tags (Alice, Boqun)
---
rust/kernel/alloc/vec_ext.rs | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/rust/kernel/alloc/vec_ext.rs b/rust/kernel/alloc/vec_ext.rs
index 6a916fcf8bf1..ffcf8a19f715 100644
--- a/rust/kernel/alloc/vec_ext.rs
+++ b/rust/kernel/alloc/vec_ext.rs
@@ -4,6 +4,7 @@
use super::{AllocError, Flags};
use alloc::vec::Vec;
+use core::ptr;
use core::result::Result;
/// Extensions to [`Vec`].
@@ -137,6 +138,15 @@ fn reserve(&mut self, additional: usize, flags: Flags) -> Result<(), AllocError>
let (ptr, len, cap) = destructure(self);
+ // We need to make sure that ptr is either NULL or comes from a previous call to
+ // `krealloc_aligned`. A `Vec<T>`'s `ptr` value is not guaranteed to be NULL and might be
+ // dangling after being created with `Vec::new`. Instead, we can rely on `Vec<T>'s capacity
+ // to be zero if no memory has been allocated yet.
+ let ptr = match cap {
+ 0 => ptr::null_mut(),
+ _ => ptr,
+ };
+
// SAFETY: `ptr` is valid because it's either NULL or comes from a previous call to
// `krealloc_aligned`. We also verified that the type is not a ZST.
let new_ptr = unsafe { super::allocator::krealloc_aligned(ptr.cast(), layout, flags) };
base-commit: 2c1092853f163762ef0aabc551a630ef233e1be3
--
2.44.0
next reply other threads:[~2024-04-30 12:13 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-30 12:13 Danilo Krummrich [this message]
2024-04-30 19:25 ` [PATCH v2] rust: alloc: fix dangling pointer in VecExt<T>::reserve() Wedson Almeida Filho
2024-04-30 22:04 ` Danilo Krummrich
2024-05-07 3:24 ` Wedson Almeida Filho
2024-05-07 20:18 ` Danilo Krummrich
2024-05-01 8:20 ` Benno Lossin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240430121322.2660-1-dakr@redhat.com \
--to=dakr@redhat.com \
--cc=a.hindborg@samsung.com \
--cc=alex.gaynor@gmail.com \
--cc=aliceryhl@google.com \
--cc=benno.lossin@proton.me \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=gary@garyguo.net \
--cc=ojeda@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=wedsonaf@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).