linux-kernel - Re: [PATCHv2 1/4] actual sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <473D03CB.4020409@cosmosbay.com>
Date:	Fri, 16 Nov 2007 03:43:23 +0100
From:	Eric Dumazet <dada1@...mosbay.com>
To:	Ulrich Drepper <drepper@...hat.com>
CC:	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	mingo@...e.hu, tglx@...utronix.de, torvalds@...ux-foundation.org
Subject: Re: [PATCHv2 1/4] actual sys_indirect code

Ulrich Drepper a écrit :
> This is the actual architecture-independent part of the system call
> implementation.
> 

> +
> +long sys_indirect(struct indirect_registers __user *userregs,
> +		  void __user *userparams, size_t paramslen)
> +{
> +	struct indirect_registers regs;
> +	long result;
> +
> +	if (copy_from_user(&regs, userregs, sizeof(regs)))
> +		return -EFAULT;
> +
> +	switch (INDIRECT_SYSCALL (&regs))
> +	{
> +#ifdef __NR_accept
> +	case __NR_accept:
> +#endif
> +#ifdef __NR_socketpair
> +	case __NR_socketpair:
> +#endif
> +#ifdef __NR_socket
> +	case __NR_socket:
> +#endif
> +#ifdef __NR_socketcall
> +	case __NR_socketcall:
> +#endif
> +		break;
> +
> +	default:
> +		return -EINVAL;
> +	}
> +
> +	if (paramslen > sizeof(union indirect_params))
> +		return -EINVAL;
> +	if (copy_from_user(&current->indirect_params, userparams, paramslen))

Here, you should clear current->indirect_params before returning -EFAULT
                 {
                 memset(&current->indirect_params, 0, paramslen);
> +		return -EFAULT;
                 }
copy_from_user could do a partial copy (so dirty first bytes of 
indirect_params) and all furthers calls to socket()/open() and so on could be 
broken.

> +
> +	result = CALL_INDIRECT(&regs);
> +
> +	memset(&current->indirect_params, '\0', paramslen);
> +
> +	return result;
> +}
> -

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/