netdev - Re: [PATCH net] ptp: improve max_adj check against unreasonable values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Jun 2021 22:13:24 -0700
From:   Richard Cochran <richardcochran@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     davem@...emloft.net, jacob.e.keller@...el.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH net] ptp: improve max_adj check against unreasonable
 values

On Mon, Jun 14, 2021 at 03:24:05PM -0700, Jakub Kicinski wrote:
> Scaled PPM conversion to PPB may (on 64bit systems) result
> in a value larger than s32 can hold (freq/scaled_ppm is a long).
> This means the kernel will not correctly reject unreasonably
> high ->freq values (e.g. > 4294967295ppb, 281474976645 scaled PPM).
> 
> The conversion is equivalent to a division by ~66 (65.536),
> so the value of ppb is always smaller than ppm, but not small
> enough to assume narrowing the type from long -> s32 is okay.
> 
> Note that reasonable user space (e.g. ptp4l) will not use such
> high values, anyway, 4289046510ppb ~= 4.3x, so the fix is
> somewhat pedantic.

But still important to defend against fuzzing!
 
> Fixes: d39a743511cd ("ptp: validate the requested frequency adjustment.")
> Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>

Acked-by: Richard Cochran <richardcochran@...il.com>