linux-kernel - Re: [PATCH] perf buildid: fix off-by-one in write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160420132304.GN3677@kernel.org>
Date:	Wed, 20 Apr 2016 10:23:04 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Adrian Hunter <adrian.hunter@...el.com>
Cc:	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] perf buildid: fix off-by-one in write_buildid()

Em Wed, Apr 20, 2016 at 03:36:22PM +0300, Adrian Hunter escreveu:
> On 19/04/16 16:40, Arnaldo Carvalho de Melo wrote:
> > Em Tue, Apr 19, 2016 at 11:17:27AM +0300, Andrey Ryabinin escreveu:
> >> write_buildid() increments 'name_len' with intention to take into account
> >> trailing zero byte. However, 'name_len' was already incremented in
> >> machine__write_buildid_table() before.
> >> So this leads to out-of-bounds read in do_write():
> > 
> > Adrian, can you please take a look at the db-export improvements made in
> > this series? It'd be good to have your ack for those,
> 
> You mean the patches from Chris Phlipot - yes I'll look at them.

Yeah, thanks,

- Arnaldo