linux-kernel - [PATCH 29/44] kdbus: Improve tests on incrementing quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu,  8 Oct 2015 14:31:58 +0300
From:	Sergei Zviagintsev <sergei@...v.net>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Daniel Mack <daniel@...que.org>,
	David Herrmann <dh.herrmann@...glemail.com>,
	Djalal Harouni <tixxdz@...ndz.org>
Cc:	linux-kernel@...r.kernel.org, Sergei Zviagintsev <sergei@...v.net>
Subject: [PATCH 29/44] kdbus: Improve tests on incrementing quota

 - Rewrite

       quota->memory + memory > U32_MAX

   as

       U32_MAX - quota->memory < memory

   There is no overflow issue in the original expression on 32-bit
   because the previous one (available - quota->memory < memory)
   guarantees that quota->memory + memory doesn't exceed `available'
   which is <= U32_MAX in that case. But lets replace it with less
   ambiguous variant.

 - Replace

       quota->fds + fds < quota->fds ||
       quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER

   with

       quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
       KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds

   Reading the code, one can assume that the first original expression
   is there to ensure that quota->fds won't overflow after
   quota->fds += fds, but what it really does is testing for
   size_t overflow in `quota->fds + fds' to be safe in the second
   expression (as fds is size_t, quota->fds is converted to bigger
   type).

   Rewrite it in more obvious way. KDBUS_CONN_MAX_FDS_PER_USER is
   checked at compile time to fill in quota->fds type (there is
   BUILD_BUG_ON), so no further checks for quota->fds overflow are
   needed.

Signed-off-by: Sergei Zviagintsev <sergei@...v.net>
---
 ipc/kdbus/connection.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ipc/kdbus/connection.c b/ipc/kdbus/connection.c
index c57ff2c846ee..b32b4f981618 100644
--- a/ipc/kdbus/connection.c
+++ b/ipc/kdbus/connection.c
@@ -717,12 +717,12 @@ int kdbus_conn_quota_inc(struct kdbus_conn *c, struct kdbus_user *u,

 	if (available < quota->memory ||
 	    available - quota->memory < memory ||
-	    quota->memory + memory > U32_MAX)
+	    U32_MAX - quota->memory < memory)
 		return -ENOBUFS;
 	if (quota->msgs >= KDBUS_CONN_MAX_MSGS)
 		return -ENOBUFS;
-	if (quota->fds + fds < quota->fds ||
-	    quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER)
+	if (quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
+	    KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds)
 		return -EMFILE;

 	quota->memory += memory;
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/