linux-kernel - Re: bug in generic strncpy_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Feb 2013 15:43:55 -0800
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Heiko Carstens <heiko.carstens@...ibm.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Gerald Schaefer <gerald.schaefer@...ibm.com>,
	Martin Schwidefsky <schwidefsky@...ibm.com>
Subject: Re: bug in generic strncpy_from_user

On Tue, Feb 26, 2013 at 8:08 AM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> It is totally untested, though.  Does it work for you (and we should
> do the same thing for the grows-up case, obviously)?

Ok, thinking about this more, this is not good enough.

There is one case where growing into the previous/next vma is
perfectly ok: when the previous/next vma is the same stack vma, and
the reason we expanded it was because we had somehow unmapped the
stack in the middle.

Which isn't common or normal, but it has been known to happen. People
doing things like unmapping sensitive data in the middle of the stack
or whatever. We explicitly allow that case for the stack guard page
for that reason.

So I'll need to extend on that logic a bit more.

                    Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/