linux-kernel - RE: [char-misc-next 3/3] mei: report consistently copy_from/to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5B8DA87D05A7694D9FA63FD143655C1B1AF8F5F6@HASMSX106.ger.corp.intel.com>
Date:	Tue, 11 Mar 2014 22:39:03 +0000
From:	"Winkler, Tomas" <tomas.winkler@...el.com>
To:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"arnd@...db.de" <arnd@...db.de>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"Usyskin, Alexander" <alexander.usyskin@...el.com>
Subject: RE: [char-misc-next 3/3] mei: report consistently copy_from/to_user
 failures



> On Tue, 11 Mar 2014 14:49:25 +0200
> Tomas Winkler <tomas.winkler@...el.com> wrote:
> 
> > From: Alexander Usyskin <alexander.usyskin@...el.com>
> >
> > Consistently display error on possible copy_from/to_user failures
> > and replace dev_dbg with dev_err
> 
> NAK
> 
> This allows users to flood the logs by deliberately causing lots of these
> failed to copy data error messages, and if they can flood the logs they
> can hide other stuff.
> 
> The -EFAULT cases should be consistent - but consistently *not* logged.

Yep, that's really looks like a possible exploit, please drop this patch.
Tomas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/