linux-kernel - Re: [PATCH v2] sctp: don't dereference ptr before leaving _sctp_walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Jul 2017 19:33:54 +0200
From:   Alexander Potapenko <glider@...gle.com>
To:     David Miller <davem@...emloft.net>
Cc:     Dmitriy Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        lucien xin <lucien.xin@...il.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH v2] sctp: don't dereference ptr before leaving _sctp_walk_{params,errors}()

On Fri, Jul 14, 2017 at 7:23 PM, David Miller <davem@...emloft.net> wrote:
> From: Alexander Potapenko <glider@...gle.com>
> Date: Fri, 14 Jul 2017 18:33:01 +0200
>
>> On Fri, Jul 14, 2017 at 5:58 PM, David Miller <davem@...emloft.net> wrote:
>>> From: Alexander Potapenko <glider@...gle.com>
>>> Date: Fri, 14 Jul 2017 12:03:29 +0200
>>>
>>>>  v2: per comment from David Miller, make sure the whole iterator->length
>>>>      fits into the remaining buffer.
>>>
>>> Please compile and functionally test your changes:
>>>
>>> In file included from ./include/linux/compiler.h:58:0,
>>>                  from ./include/uapi/linux/stddef.h:1,
>>>                  from ./include/linux/stddef.h:4,
>>>                  from ./include/uapi/linux/posix_types.h:4,
>>>                  from ./include/uapi/linux/types.h:13,
>>>                  from ./include/linux/types.h:5,
>>>                  from net/sctp/sm_statefuns.c:48:
>>> net/sctp/sm_statefuns.c: In function ‘sctp_sf_do_reconf’:
>>> ./include/net/sctp/sctp.h:472:24: error: unknown type name ‘sctp_paramhdr_t’
>>>       (pos.v + offsetof(sctp_paramhdr_t, length) + sizeof(pos.p->length) <\
>>>                         ^
>> Oops. Fixed.
>
> Did you functionally test the new version or just do a quick compile
> check and resubmit?
I've checked that the kernel still works, but unfortunately I couldn't
check whether or not this affected the uninit memory, as KMSAN
currently works on a fixed kernel revision. The compilation error was
actually caused by me failing to test the kernel when porting the fix
from that revision to upstream.

> I really want you to test this if the logic has been changed.
Do you mean any specific tests in addition to, say, running the
reproducer on which the uninit use was reported?

Thanks


-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg