linux-kernel - Re: [PATCH] fix read past end of array in md/linear.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <17908.35664.68737.48529@notabene.brown>
Date:	Mon, 12 Mar 2007 10:05:52 +1100
From:	Neil Brown <neilb@...e.de>
To:	Andy Isaacson <adi@...apodia.org>
Cc:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] fix read past end of array in md/linear.c

On Thursday March 8, adi@...apodia.org wrote:
> On Thu, Mar 08, 2007 at 12:52:04PM -0800, Andy Isaacson wrote:
> > Index: linus/drivers/md/linear.c
> > ===================================================================
> > --- linus.orig/drivers/md/linear.c	2007-03-02 11:35:55.000000000 -0800
> > +++ linus/drivers/md/linear.c	2007-03-07 13:10:30.000000000 -0800
> > @@ -188,7 +188,7 @@
> >  	for (i=0; i < cnt-1 ; i++) {
> >  		sector_t sz = 0;
> >  		int j;
> > -		for (j=i; i<cnt-1 && sz < min_spacing ; j++)
> > +		for (j=i; j<cnt-1 && sz < min_spacing ; j++)
> >  			sz += conf->disks[j].size;
> >  		if (sz >= min_spacing && sz < conf->hash_spacing)
> >  			conf->hash_spacing = sz;
> 
> Forgot to add:
> 
> Signed-off-by: Andrew Isaacson <adi@...apodia.org>

And
 Acked-by: NeilBrown <neilb@...e.de>

Thanks!

I would have replied earlier but I wanted to make sure I understood
exactly what the possible consequences of this bug were.. and they are
quite benign.
The worst possible outcome is going so far off the end of the array
that you hit un-mapped memory and Oops.

If that doesn't happen, then the next worst option is that the hash
table is sized poorly and you spend a few more cycles than needed
choosing the target device for the request (we still always choose the
right device).

Thanks,
NeilBrown
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/