linux-kernel - Re: [patch 0/5] early params NULL pointer deref fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20080709152505.GA6784@asus>
Date:	Wed, 9 Jul 2008 19:25:05 +0400
From:	Cyrill Gorcunov <gorcunov@...il.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	akpm@...ux-foundation.org, hpa@...or.com, tglx@...utronix.de,
	andi@...stfloor.org, linux-kernel@...r.kernel.org
Subject: Re: [patch 0/5] early params NULL pointer deref fix

[Ingo Molnar - Wed, Jul 09, 2008 at 01:57:48PM +0200]
| 
| * Cyrill Gorcunov <gorcunov@...il.com> wrote:
| 
| >  This series fix a possible NULL pointer deref in case if user was 
| > stupid enough to pass boot parameter without a mandatory value
| > 
| >  Actually there is a number of such issues on other platforms too 
| > (like powerpc, sh, s390) so I think it should be fixed too (any 
| > volunteers?)
| > 
| >  Any comments are welcome.
| 
| thanks Cyrill, i picked them up.
| 
| I'm wondering, would it be possible to filter NULL out on one higher 
| level? Would it break any existing functionality? (i dont think it would 
| or should)
| 
| 	Ingo
| 

well, actually it would and should :)

Currently parser does a simple thing - just parses command line and split
key/param pairs. But kernel code uses it in three ways:

 1) as simple flag specified on booting
 2) as key and value
 3) combination of 1) and 2)

So for now I don't see any simple solution for this. We could use '='
param postfix to specify that a mandatory value required for param and
throw out any misconfigured boot options but it will make way 3) invalid
so kernel code will have to be fixed then. So some additional review
and conversation about this are needed.

		- Cyrill -
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/