linux-kernel - Re: [PATCH] drivers/xen: avoid out-of-range write in xen_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130107150816.GC3219@phenom.dumpdata.com>
Date:	Mon, 7 Jan 2013 10:08:16 -0500
From:	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:	Nickolai Zeldovich <nickolai@...il.mit.edu>, JBeulich@...e.com,
	xen-devel@...ts.xensource.com
Cc:	Jeremy Fitzhardinge <jeremy@...p.org>,
	linux-kernel@...r.kernel.org,
	virtualization@...ts.linux-foundation.org
Subject: Re: [PATCH] drivers/xen: avoid out-of-range write in xen_add_device

On Sat, Jan 05, 2013 at 02:18:46PM -0500, Nickolai Zeldovich wrote:
> xen_add_device() in drivers/xen/pci.c allocates a struct
> physdev_pci_device_add on the stack and then writes to optarr[0].
> The previous declaration of struct physdev_pci_device_add contained
> a zero-length optarr[] array, presumably assuming it will be allocated
> with kmalloc with a suitable number of trailing elements, but the code in
> xen_add_device() as a result wrote past the end of the (stack-allocated)
> data structure.
> 
> Since xen_add_device() is the only use of struct physdev_pci_device_add
> in the kernel, turn optarr[] into a single-element array instead.
> 

Lets include Jan and Xen-devel on this email - as this is also changing
the official header that is used in Xen.

> Signed-off-by: Nickolai Zeldovich <nickolai@...il.mit.edu>
> ---
>  include/xen/interface/physdev.h |    6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
> index 1844d31..24fd218 100644
> --- a/include/xen/interface/physdev.h
> +++ b/include/xen/interface/physdev.h
> @@ -242,11 +242,7 @@ struct physdev_pci_device_add {
>          uint8_t bus;
>          uint8_t devfn;
>      } physfn;
> -#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L
> -    uint32_t optarr[];
> -#elif defined(__GNUC__)
> -    uint32_t optarr[0];
> -#endif
> +    uint32_t optarr[1];
>  };
>  
>  #define PHYSDEVOP_pci_device_remove     26
> -- 
> 1.7.10.4
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/