linux-kernel - RE: [PATCH] Tools: hv: correct payload size in netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fa3fb59894d045fa929feb151e0a1138@SN2PR03MB061.namprd03.prod.outlook.com>
Date:	Wed, 7 Aug 2013 13:26:33 +0000
From:	KY Srinivasan <kys@...rosoft.com>
To:	Olaf Hering <olaf@...fle.de>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] Tools: hv: correct payload size in netlink_send



> -----Original Message-----
> From: Olaf Hering [mailto:olaf@...fle.de]
> Sent: Wednesday, August 07, 2013 9:07 AM
> To: KY Srinivasan; gregkh@...uxfoundation.org
> Cc: linux-kernel@...r.kernel.org; Olaf Hering
> Subject: [PATCH] Tools: hv: correct payload size in netlink_send
> 
> netlink_send is supposed to send just the cn_msg+hv_kvp_msg via netlink.
> Currently it sets an incorrect iovec size, as reported by valgrind.
> 
> In the case of registering with the kernel the allocated buffer is large
> enough to hold nlmsghdr+cn_msg+hv_kvp_msg, no overrun happens. In the
> case of responding to the kernel the cn_msg is located in the middle of
> recv_buffer, after the nlmsghdr. Currently the code in netlink_send adds
> also the size of nlmsghdr to the payload. But nlmsghdr is a separate
> iovec. This leads to an (harmless) out-of-bounds access when the kernel
> processes the iovec. Correct the iovec size of the cn_msg to be just
> cn_msg + its payload.

Thanks Olaf.

> 
> Signed-off-by: Olaf Hering <olaf@...fle.de>
Signed-off-by: K. Y. Srinivasan <kys@...rosoft.com>

> ---
>  tools/hv/hv_kvp_daemon.c | 2 +-
>  tools/hv/hv_vss_daemon.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
> index d3bcb84..1bd1ad1 100644
> --- a/tools/hv/hv_kvp_daemon.c
> +++ b/tools/hv/hv_kvp_daemon.c
> @@ -1399,7 +1399,7 @@ netlink_send(int fd, struct cn_msg *msg)
>  	char buffer[64];
>  	struct iovec iov[2];
> 
> -	size = NLMSG_SPACE(sizeof(struct cn_msg) + msg->len);
> +	size = sizeof(struct cn_msg) + msg->len;
> 
>  	nlh = (struct nlmsghdr *)buffer;
>  	nlh->nlmsg_seq = 0;
> diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
> index 6b4f2fa..2f1f53f 100644
> --- a/tools/hv/hv_vss_daemon.c
> +++ b/tools/hv/hv_vss_daemon.c
> @@ -111,7 +111,7 @@ static int netlink_send(int fd, struct cn_msg *msg)
>  	char buffer[64];
>  	struct iovec iov[2];
> 
> -	size = NLMSG_SPACE(sizeof(struct cn_msg) + msg->len);
> +	size = sizeof(struct cn_msg) + msg->len;
> 
>  	nlh = (struct nlmsghdr *)buffer;
>  	nlh->nlmsg_seq = 0;



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/