linux-kernel - Re: [PATCH] Fix kfree bug in sendmsg and recvmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160217164407.GL17997@ZenIV.linux.org.uk>
Date:	Wed, 17 Feb 2016 16:44:07 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Joe Korty <joe.korty@...r.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Fix kfree bug in sendmsg and recvmsg

On Wed, Feb 17, 2016 at 11:38:05AM -0500, Joe Korty wrote:
> Fix kfree bug in recvmsg and sendmsg.
> 
> We cannot kfree(iov) when iov points to an array on the
> stack, as that has the potential of corrupting memory.
> 
> So re-introduce the if-stmt that used to protect kfree
> from this condition, code that was removed as part of
> a larger set of changes made by git commit da184284.

NAK.  You are misreading import_iovec():
        *iov = p == *iov ? NULL : p;
in the end will have iov replaced with NULL if we ended up using what
it originally pointed to.