linux-kernel - Re: [PATCH] phy: ocelot-serdes: fix out-of-bounds read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 8 Oct 2018 23:02:28 +0200
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Quentin Schulz <quentin.schulz@...tlin.com>
Cc:     Kishon Vijay Abraham I <kishon@...com>,
        "David S. Miller" <davem@...emloft.net>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] phy: ocelot-serdes: fix out-of-bounds read

Hey Quentin,

On 10/8/18 10:55 PM, Quentin Schulz wrote:
> Hi Gustavo,
> 
> On Mon, Oct 08, 2018 at 08:06:49PM +0200, Gustavo A. R. Silva wrote:
>> Currently, there is an out-of-bounds read on array ctrl->phys,
>> once variable i reaches the maximum array size of SERDES_MAX
>> in the for loop.
>>
>> Fix this by changing the condition in the for loop from
>> i <= SERDES_MAX to i < SERDES_MAX.
>>
> 
> Thanks for the heads up. However, as defined today, SERDES_MAX is a
> valid value so I need it in the iteration. There are two possible fixes
> though:
> 

Oh okay. I've got it.

> Either we let all the for loops as `for (i = 0; i <= SERDES_MAX; i++)`
> and define ctrl->phys as an array of size SERDES_MAX + 1.
> 
> Or we modify the for loops as `for (i = 0; i < SERDES_MAX; i++)` and we
> update SERDES_MAX in include/dt-bindings/phy/phy-ocelot-serdes.h to be
> SERDES6G_MAX + 1.
> 

I think this one is better.

> As you wish!
> 

I'll send v2 shortly.

Thanks for the feedback. :)
--
Gustavo