linux-kernel - Re: [PATCH] NFS: Avoid cross-structure casting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 05 Apr 2017 11:09:57 +1000
From:   NeilBrown <neilb@...e.com>
To:     Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org
Cc:     Trond Myklebust <trond.myklebust@...marydata.com>,
        Anna Schumaker <anna.schumaker@...app.com>,
        linux-nfs@...r.kernel.org
Subject: Re: [PATCH] NFS: Avoid cross-structure casting

On Tue, Apr 04 2017, Kees Cook wrote:

> When the call to nfs_devname() fails, the error path attempts to retain
> the error via the mnt variable, but this requires a cast across very
> different types (char * to struct vfsmount), which the upcoming structure
> layout randomization plugin flags as being potentially dangerous in the
> face of randomization. This is a false positive, but what this code
> actually wants to do is retain the error value, so this patch explicitly
> sets it, instead of using what seems to be an unexpected cast.
>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
>  fs/nfs/namespace.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
> index 786f17580582..89f50bf12f52 100644
> --- a/fs/nfs/namespace.c
> +++ b/fs/nfs/namespace.c
> @@ -259,9 +259,10 @@ struct vfsmount *nfs_do_submount(struct dentry *dentry, struct nfs_fh *fh,
>  	if (page == NULL)
>  		goto out;
>  	devname = nfs_devname(dentry, page, PAGE_SIZE);
> -	mnt = (struct vfsmount *)devname;
> -	if (IS_ERR(devname))
> +	if (IS_ERR(devname)) {
> +		mnt = ERR_PTR(PTR_ERR(devname));

Allow me to introduce you to ERR_CAST()
/**
 * ERR_CAST - Explicitly cast an error-valued pointer to another pointer type
 * @ptr: The pointer to cast.
 *
 * Explicitly cast an error-valued pointer to another pointer type in such a
 * way as to make it clear that's what's going on.
 */

So:
 +		mnt = ERR_CAST(devname);

NeilBrown

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)