linux-kernel - [PATCH] fs: make sure we do not read beyond allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131003163411.GA17101@www.outflux.net>
Date:	Thu, 3 Oct 2013 09:34:11 -0700
From:	Kees Cook <keescook@...omium.org>
To:	linux-kernel@...r.kernel.org
Cc:	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org, Dmitry Vyukov <dvyukov@...gle.com>
Subject: [PATCH] fs: make sure we do not read beyond allocation

In dentry_string_cmp (via__d_lookup_rcu), when CONFIG_DCACHE_WORD_ACCESS
is set, word-width memory reads are performed. However, the string
allocation size may not be a multiple of the word size. To avoid reading
past the end of such an allocation, we must allocate in multiples of
the word size.

Found by the Kernel Address Sanitizer project:
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
Signed-off-by: Kees Cook <keescook@...omium.org>
---
 fs/dcache.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 4100030..23665e2 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1570,7 +1570,11 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
 	 */
 	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
 	if (name->len > DNAME_INLINE_LEN-1) {
-		dname = kmalloc(name->len + 1, GFP_KERNEL);
+		size_t alloc_size = name->len + 1;
+#ifdef CONFIG_DCACHE_WORD_ACCESS
+		alloc_size = round_up(alloc_size, sizeof(unsigned long));
+#endif
+		dname = kmalloc(alloc_size, GFP_KERNEL);
 		if (!dname) {
 			kmem_cache_free(dentry_cache, dentry); 
 			return NULL;
-- 
1.7.9.5


-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/