linux-kernel - Re: [PATCH v2] kref: Avoid null pointer dereference after WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jKR2os94662hRiECowoLp85A=_fDuMXOGq2U8R6ba4ywA@mail.gmail.com>
Date:   Tue, 27 Jun 2017 12:34:01 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     Andi Kleen <ak@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Hellstrom <thellstrom@...are.com>,
        Daniel Micay <danielmicay@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] kref: Avoid null pointer dereference after WARN

On Tue, Jun 27, 2017 at 12:26 PM, Jason A. Donenfeld <Jason@...c4.com> wrote:
> On Tue, Jun 27, 2017 at 9:22 PM, Andi Kleen <ak@...ux.intel.com> wrote:
>> Who would actually set mman_min_addr incorrectly?
>
> Historically there have been quite a few bypasses of mmap_min_addr,
> actually. This is well-trodden ground.

Targeting things in /proc/sys via confused privileged helpers is
extremely common. See Chrome OS pwn2own exploits (targetting modprobe
sysctl), and plenty of others. Modern attack methodology is rarely a
single-bug attack, but rather a chain of bugs, which may include
producing or exploiting weak userspace configurations to soften the
kernel.

Regardless, it's a fair point that checking this unconditionally is
wasteful. Strangely this doesn't help:

-               BUG_ON(release == NULL);
+               if (!__builtin_constant_p(release))
+                       BUG_ON(release == NULL);

When nearly all callers pass a function directly:

...
drivers/block/rbd.c:            kref_put(&spec->kref, rbd_spec_free);
drivers/char/hw_random/core.c:          kref_put(&rng->ref, cleanup_rng);
drivers/char/ipmi/ipmi_msghandler.c:
kref_put(&e->intf->refcount, intf_free);
...

Hmmm

-Kees

-- 
Kees Cook
Pixel Security