linux-kernel - Re: [PATCH] [RFC] fs/binfmt_elf: work around bogus ubsan array-bounds warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 31 Jul 2017 15:13:49 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Frederic Weisbecker <fweisbec@...il.com>,
        Rik van Riel <riel@...hat.com>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        Dmitry Safonov <dsafonov@...tuozzo.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] [RFC] fs/binfmt_elf: work around bogus ubsan array-bounds warning

On Mon, Jul 31, 2017 at 2:52 AM, Arnd Bergmann <arnd@...db.de> wrote:
> Using copy_to_user instead of __copy_to_user shuts up the warning here
> and is harmless, but is otherwise a completely bogus change as
> the function is still using a mix of __copy_to_user and copy_to_user.
>
> I have not found out why create_elf_tables() uses the __copy_to_user
> version in the first place, and the right answer might be that it
> should simply use copy_to_user() and put_user() everywhere.

IIUC, __copy*() is allowed here because the kernel is operating on an
already sanity checked pointer (i.e. a freshly kernel-allocated
stack). I wouldn't expect swapping in copy*() to have noticeable
performance here, though if there was, it would be a constant change
(the ELF tables are a per-arch fixed size).

-Kees

-- 
Kees Cook
Pixel Security