linux-kernel - Re: [PATCH 1/2] raw: test against runtime value of max_raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140204223419.GB2696@kroah.com>
Date:	Tue, 4 Feb 2014 14:34:19 -0800
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Paul Bolle <pebolle@...cali.nl>
Cc:	Arnd Bergmann <arnd@...db.de>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] raw: test against runtime value of max_raw_minors

On Tue, Feb 04, 2014 at 11:23:12PM +0100, Paul Bolle wrote:
> bind_get() checks the device number it is called with. It uses
> MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile
> time while the actual number of raw devices can be set at runtime. This
> means the test can either be too strict or too lenient. And if the test
> ends up being too lenient bind_get() might try to access memory beyond
> what was allocated for "raw_devices".
> 
> So check against the runtime value (max_raw_minors) in this function.
> 
> Signed-off-by: Paul Bolle <pebolle@...cali.nl>
> ---
>  drivers/char/raw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/char/raw.c b/drivers/char/raw.c
> index f3223aa..6e8d65e 100644
> --- a/drivers/char/raw.c
> +++ b/drivers/char/raw.c
> @@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev)
>  	struct raw_device_data *rawdev;
>  	struct block_device *bdev;
>  
> -	if (number <= 0 || number >= MAX_RAW_MINORS)
> +	if (number <= 0 || number >= max_raw_minors)

Are you sure?  For some reason, I thought this was changed to be this
way a long time ago, can you please dig through the git archives, and
even the history.git tree, to verify that this is correct and you aren't
just making this be as it was before?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/