linux-kernel - Re: int overflow in io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2dc32e3a-d543-c751-3b19-24e83cba35e5@suse.cz>
Date:   Wed, 26 Oct 2016 13:44:28 +0200
From:   Jiri Slaby <jslaby@...e.cz>
To:     Dmitry Vyukov <dvyukov@...gle.com>,
        Benjamin LaHaise <bcrl@...ck.org>
Cc:     Jan Kara <jack@...e.cz>, Alexander Viro <viro@...iv.linux.org.uk>,
        linux-aio <linux-aio@...ck.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        Sasha Levin <sasha.levin@...cle.com>,
        Andrey Ryabinin <ryabinin.a.a@...il.com>
Subject: Re: int overflow in io_getevents

Hi,

what's the status of this? I have just hit it now and don't see it merged.

On 01/07/2016, 05:27 PM, Dmitry Vyukov wrote:
> On Thu, Jan 7, 2016 at 4:52 PM, Benjamin LaHaise <bcrl@...ck.org> wrote:
>> On Thu, Jan 07, 2016 at 04:37:43PM +0100, Dmitry Vyukov wrote:
>>> pass ts to the function
>>
>> Yeah, I should have had my morning coffee before hitting send.  Updated
>> below, and hopefully final.  Checked with a test program to confirm that
>> the huge value of seconds in timespec correctly waits, and that negative
>> or other invalid values fail with EINVAL (download from
>> http://www.kvack.org/~bcrl/aio-io_getevents-timespec.c ).
>>
>>                 -ben
>> --
>> "Thought is the essence of where you are now."
> 
> 
> Acked-by: Dmitry Vyukov <dvyukov@...gle.com>
> 
> Thanks!
> 
>> commit 49b78150bc5762c58cfb8b19a859c354cf1a71ac
>> Author: Benjamin LaHaise <bcrl@...ck.org>
>> Date:   Thu Jan 7 10:37:58 2016 -0500
>>
>>     aio: handle integer overflow in io_getevents() timespec usage
>>
>>     Dmitry Vyukov reported an integer overflow in io_getevents() when
>>     running a fuzzer.  Upon investigation, the triggers appears to be that
>>     an invalid value for the tv_sec or tv_nsec was passed in which is not
>>     handled by timespec_to_ktime().  This patch fixes that by making
>>     io_getevents() return -EINVAL when timespec_valid() checks fail.  We
>>     use timespec_valid() instead of timespec_valid_strict() to avoid issues
>>     caused by userspace not knowing the cutoff for KTIME_SEC_MAX.
>>
>>     Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
>>     Signed-off-by: Benjamin LaHaise <bcrl@...ck.org>
>>
>> diff --git a/fs/aio.c b/fs/aio.c
>> index 155f842..e0d5398 100644
>> --- a/fs/aio.c
>> +++ b/fs/aio.c
>> @@ -1269,6 +1269,8 @@ static long read_events(struct kioctx *ctx, long min_nr, long nr,
>>
>>                 if (unlikely(copy_from_user(&ts, timeout, sizeof(ts))))
>>                         return -EFAULT;
>> +               if (!timespec_valid(&ts))
>> +                       return -EINVAL;
>>
>>                 until = timespec_to_ktime(ts);


-- 
js
suse labs