linux-kernel - Re: [PATCH net-next v5 05/19] net: ethtool: add new ETHTOOL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20151216.113814.2025166082777387327.davem@davemloft.net>
Date:	Wed, 16 Dec 2015 11:38:14 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	ddecotig@...il.com
Cc:	ben@...adent.org.uk, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, linux-api@...r.kernel.org,
	linux-mips@...ux-mips.org, fcoe-devel@...n-fcoe.org,
	akpm@...ux-foundation.org, tj@...nel.org, edumazet@...gle.com,
	eugenia@...lanox.co.il, ogerlitz@...lanox.com, idos@...lanox.com,
	joe@...ches.com, saeedm@...lanox.com, _govind@....com,
	VenkatKumar.Duvvuru@...lex.Com, jeffrey.t.kirsher@...el.com,
	pshelar@...ira.com, eswierk@...portsystems.com,
	robert.w.love@...el.com, JBottomley@...allels.com,
	Yuval.Mintz@...gic.com, linux@...musvillemoes.dk,
	decot@...glers.com
Subject: Re: [PATCH net-next v5 05/19] net: ethtool: add new
 ETHTOOL_GSETTINGS/SSETTINGS API

From: David Decotigny <ddecotig@...il.com>
Date: Mon, 14 Dec 2015 13:03:52 -0800

> +static int ethtool_get_ksettings(struct net_device *dev, void __user *useraddr)
> +{
 ...
> +	if (__ETHTOOL_LINK_MODE_MASK_NU32
> +	    != ksettings.parent.link_mode_masks_nwords) {
> +		/* wrong link mode nbits requested */
> +		memset(&ksettings, 0, sizeof(ksettings));
> +		/* keep cmd field reset to 0 */
> +		/* send back number of words required as negative val */
> +		compiletime_assert(__ETHTOOL_LINK_MODE_MASK_NU32 <= S8_MAX,
> +				   "need too many bits for link modes!");
> +		ksettings.parent.link_mode_masks_nwords
> +			= -((s8)__ETHTOOL_LINK_MODE_MASK_NU32);

I'm trying to understand how this can work.

Supposedly, the link_mode_masks_nwords field is there so that we can
add new link modes yet still work with tools built against any
particular link mode list in the UAPI header files.

But here you're forcing the value of link_mode_masks_nwords and then
copying that amount back to userspace.  If the user allocated less
space than the the link mode list in the kernel supports, we will
overwrite past the end of the user's usettings object.

You cannot unconditionally copy sizeof(usettings) back to the user,
as store_ksettings_for_user() will do.

I think you have to truncate here, copying only the array elements the
user's structure actually has space for.  That's the only way this can
work.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/