linux-kernel - Re: [PATCH v1] seq_file: Fix overflow condition in seq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 20 Aug 2013 13:33:56 +0530
From:	Arun KS <arunks.linux@...il.com>
To:	Al Viro <viro@...iv.linux.org.uk>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Matthew Wilcox <matthew@....cx>,
	Bruce Fields <bfields@...ldses.org>,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	vinayak menon <vinayakm.list@...il.com>,
	Nagachandra P <nagachandra@...il.com>,
	Vikram MP <mp.vikram@...il.com>
Subject: Re: [PATCH v1] seq_file: Fix overflow condition in seq_commit

Hi Al Viro,

On Tue, Aug 20, 2013 at 1:06 PM, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Tue, Aug 20, 2013 at 12:51:56PM +0530, Arun KS wrote:
>
>> d_path expects the pathname to be less than 64 bytes. If its more than
>> 64, it returns -ENAMETOOLONG.
>
> ?!?!?  d_path() does not expect anything of that sort - it can very
> well produce names much longer, without ENAMETOOLONG.
>
>> char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
>>                         const char *fmt, ...)
>> {
>>         va_list args;
>>         char temp[64];
>>         int sz;
>>
>>         va_start(args, fmt);
>>         sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
>>         va_end(args);
>>
>>         if (sz > sizeof(temp) || sz > buflen)
>>                 return ERR_PTR(-ENAMETOOLONG);
>>
>>         buffer += buflen - sz;
>>         return memcpy(buffer, temp, sz);
>> }
>
> Aha.  _That_ is a bug, all right - dynamic_dname() is simply not suitable
> for that kind of uses.  ashmem.c is certainly abusing shmem_file_setup();
> feeding that kind of mess as dentry name is a Bad Idea(tm).  Anyway,
> I'd suggest this for a fix:
>
>         va_list args;
>         size_t sz;
>         va_start(args, fmt);
>         sz = vsnprintf(NULL, 0, fmt, args) + 1;
>         va_end(args);
>         if (sz > buflen)
>                 return ERR_PTR(-ENAMETOOLONG);
>         va_start(args, fmt);
>         buffer += buflen - sz;
>         vsprintf(buffer, fmt, args);
>         va_end(args);
>         return buffer;
>
> Either right in dynamic_dname(), or as possibly_fucking_long_dname(),
> to be used by shmem.c...

This fixes the problem.

Thanks,
Arun
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/