lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <YySOewo2YUY+fk1l@kadam>
Date: Fri, 16 Sep 2022 17:55:55 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: Kees Cook <keescook@...omium.org>
Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org>,
Peter Rosin <peda@...ntia.se>, Wolfram Sang <wsa@...nel.org>,
"Gustavo A. R. Silva" <gustavo@...eddedor.com>,
linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org,
kernel-janitors@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] i2c: mux: harden i2c_mux_alloc() against integer
overflows
On Fri, Sep 16, 2022 at 06:31:45AM -0700, Kees Cook wrote:
> On Fri, Sep 16, 2022 at 11:23:25AM +0300, Dan Carpenter wrote:
> > [...]
> > net/ipv6/mcast.c:450 ip6_mc_source() saving 'size_add' to type 'int'
>
> Interesting! Are you able to report the consumer? e.g. I think a bunch
> of these would be fixed by:
>
Are you asking if I can add "passed to sock_kmalloc()" to the report?
It's possible but it's kind of a headache the way this code is written.
When you pass a function to another function in Smatch:
frob(size_add());
Then Smatch creates a fake assignment: "frob(fake_assign = size_add());"
and parses that instead. So this check only looks at the
"fake_assign = size_add();" assignment.
Attached.
regards,
dan carpenter
View attachment "check_overflow_truncated.c" of type "text/x-csrc" (1546 bytes)
Powered by blists - more mailing lists