linux-kernel - Re: [PATCH v2] firmware: fix async, manual firmware loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 20:10:56 +0100
From:   "Luis R. Rodriguez" <mcgrof@...nel.org>
To:     Yves-Alexis Perez <corsac@...sac.net>
Cc:     linux-kernel@...r.kernel.org, johannes@...solutions.net, j@...fi,
        jslaby@...e.com, teg@...m.no, kay@...y.org,
        jwboyer@...oraproject.org, dmitry.torokhov@...il.com,
        luto@...capital.net, harald@...hat.com, seth.forshee@...onical.com,
        wagi@...om.org, "Luis R . Rodriguez" <mcgrof@...nel.org>,
        Ming Lei <ming.lei@...onical.com>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org
Subject: Re: [PATCH v2] firmware: fix async, manual firmware loading

On Fri, Nov 11, 2016 at 04:32:17PM +0100, Yves-Alexis Perez wrote:
> When wait_for_completion_interruptible_timeout() is called from
> _request_firmware_load() with a large timeout value (here, MAX_JIFFY_OFFSET
> because it's a an explicit call to the user helper), its return value (a
> long) will overflow when silently casted to int, be stored as a negative
> integer and then treated as an error.
> 
> This bug was introduced in commit 68ff2a00dbf5 ("firmware_loader: handle
> timeout via wait_for_completion_interruptible_timeout()") when a delay work
> was replaced by the call to wait_for_completion_interruptible_timeout().
> 
> Fix this by re-using the timeout variable and only set retval in specific
> cases.
> 
> Signed-off-by: Yves-Alexis Perez <corsac@...sac.net>
> Fixes: 68ff2a00dbf5 "firmware_loader: handle timeout via wait_for_completion_interruptible_timeout()"
> Cc: Luis R. Rodriguez <mcgrof@...nel.org>
> Cc: Ming Lei <ming.lei@...onical.com>
> Cc: Bjorn Andersson <bjorn.andersson@...aro.org>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: stable@...r.kernel.org
> Acked-by: Luis R. Rodriguez <mcgrof@...nel.org>
> Reviewed-by: Bjorn Andersson <bjorn.andersson@...aro.org>

Sorry this commit log still does not help kernel maintainers enough, we want
them well informed immediately what the default behaviour is, what the impact
of the issue is, how broad of an issue it is, how this issue is triggered and
exactly how this can happen. I'll massage this a bit myself and re-submit,
as otherwise this work will be done by each and every single Linux kernel
maintainer working on a Linux distribution trying to determine if its correct
to merge this into their tree or not.

I'll re-submit shortly.

  Luis