netdev - Re: [PATCH] ipvs: Add boundary check on ioctl arguments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 1 Oct 2009 09:22:20 +0200
From:	Arjan van de Ven <arjan@...radead.org>
To:	Julian Anastasov <ja@....bg>
Cc:	Hannes Eder <heder@...gle.com>,
	Wensong Zhang <wensong@...ux-vs.org>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, Simon Horman <horms@...ge.net.au>
Subject: Re: [PATCH] ipvs: Add boundary check on ioctl arguments

On Wed, 30 Sep 2009 22:41:05 +0300 (EEST)
Julian Anastasov <ja@....bg> wrote:

> 
> 	Hello,
> 
> On Wed, 30 Sep 2009, Arjan van de Ven wrote:
> 
> > fair enough; updated patch below



> Later len can be checked
> additionally and surely can exceed 128 (include/linux/ip_vs.h has
> all user structures). 

the on-stack structure currently is 128 bytes though...

> Can you show the exact cmd and len
> used, may be there is error in some command or may be the
> provided user structure is wrong?

this comes from code inspection using gcc features; this
is one of the (few) cases in the kernel where gcc cannot prove
that the copy_from_user() length for the copy-to-stack is sufficiently
bounds checked. I'm trying to make sure all these cases have
complete enough checks, both for the obvious security reasons but
also to be able to then make gcc emit a warning to prevent future
issues from popping up.



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html