linux-kernel - Re: [Patch v1 1/1] RTL8712 alignment bug in 3.6.5 on ARM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121118182049.GE14643@lunn.ch>
Date:	Sun, 18 Nov 2012 19:20:49 +0100
From:	Andrew Lunn <andrew@...n.ch>
To:	Josh Coombs <josh.coombs@...il.com>
Cc:	Russell King - ARM Linux <linux@....linux.org.uk>,
	linux ARM <linux-arm-kernel@...ts.infradead.org>,
	wlanfae@...ltek.com, Larry.Finger@...inger.net,
	florian.c.schilhabel@...glemail.com, gregkh@...uxfoundation.org,
	devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
	Andrew Lunn <andrew@...n.ch>
Subject: Re: [Patch v1 1/1] RTL8712 alignment bug in 3.6.5 on ARM

> >> diff -ruN a/drivers/staging/rtl8712/rtl871x_sta_mgt.c
> >> b/drivers/staging/rtl8712/rtl871x_sta_mgt.c
> >> --- a/drivers/staging/rtl8712/rtl871x_sta_mgt.c 2012-11-05
> >> 03:57:06.000000000 -0500
> >> +++ b/drivers/staging/rtl8712/rtl871x_sta_mgt.c 2012-11-13
> >> 12:54:28.000000000 -0500
> >> @@ -55,8 +55,8 @@
> >>     NUM_STA + 4);
> >>   if (pstapriv->pallocated_stainfo_buf == NULL)
> >>   return _FAIL;
> >> - pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 -
> >> - ((addr_t)(pstapriv->pallocated_stainfo_buf) & 3);
> >> + pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 8 -
> >> + ((addr_t)(pstapriv->pallocated_stainfo_buf) & 7);
> >
> > Are you sure this is safe?  Is the allocated buffer large enough for
> > those additional 4 bytes of alignment you're adding?
> 
> I'm not certain on that, I bumped the allocations at Andrew's
> suggestion, but don't know enough to certify the changes as 100%
> correct.

Its not correct.

The original code is:

        pstapriv->pallocated_stainfo_buf = _malloc(sizeof(struct sta_info) *
                                                   NUM_STA + 4);
        if (pstapriv->pallocated_stainfo_buf == NULL)
                return _FAIL;
        pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 -
                ((addr_t)(pstapriv->pallocated_stainfo_buf) & 3);

The 4 in the _malloc() also needs increasing to 8.

    Andrew
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/