netdev - RE: [PATCH] bna: integer overflow bug in debugfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Mar 2017 01:14:05 +0000
From:   "Mody, Rasesh" <Rasesh.Mody@...ium.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>,
        Krishna Gudipati <kgudipat@...cade.com>
CC:     "Kalluru, Sudarsana" <Sudarsana.Kalluru@...ium.com>,
        Dept-GE Linux NIC Dev <Dept-GELinuxNICDev@...ium.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>
Subject: RE: [PATCH] bna: integer overflow bug in debugfs

> From: Dan Carpenter [mailto:dan.carpenter@...cle.com]
> Sent: Friday, March 17, 2017 1:53 PM
> 
> We could allocate less memory than intended because we do:
> 
> 	bnad->regdata = kzalloc(len << 2, GFP_KERNEL);
> 
> The shift can overflow leading to a crash.  This is debugfs code so the impact
> is very small.
> 
> Fixes: 7afc5dbde091 ("bna: Add debugfs interface.")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> 
> diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
> b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
> index 05c1c1dd7751..cebfe3bd086e 100644
> --- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
> +++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
> @@ -325,7 +325,7 @@ bnad_debugfs_write_regrd(struct file *file, const
> char __user *buf,
>  		return PTR_ERR(kern_buf);
> 
>  	rc = sscanf(kern_buf, "%x:%x", &addr, &len);
> -	if (rc < 2) {
> +	if (rc < 2 || len > UINT_MAX >> 2) {
>  		netdev_warn(bnad->netdev, "failed to read user buffer\n");
>  		kfree(kern_buf);
>  		return -EINVAL;

You are correct, thanks Dan for adding the check.

Acked-by: Rasesh Mody <rasesh.mody@...ium.com>