linux-kernel - Re: KASAN: stack-out-of-bounds Read in __nla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b70f69c-2b8c-f031-83d8-d53b96164d12@gmail.com>
Date:   Wed, 17 Jan 2018 08:59:01 -0800
From:   David Ahern <dsahern@...il.com>
To:     Xin Long <lucien.xin@...il.com>,
        syzbot <syzbot+03bee3680a37466775e7@...kaller.appspotmail.com>
Cc:     Jason@...c4.com, Andrey Vagin <avagin@...nvz.org>,
        davem <davem@...emloft.net>, dwindsor@...il.com,
        elena.reshetova@...el.com,
        Herbert Xu <herbert@...dor.apana.org.au>,
        johannes.berg@...el.com, LKML <linux-kernel@...r.kernel.org>,
        network dev <netdev@...r.kernel.org>,
        syzkaller-bugs@...glegroups.com,
        Américo Wang <xiyou.wangcong@...il.com>
Subject: Re: KASAN: stack-out-of-bounds Read in __nla_put

On 1/17/18 2:39 AM, Xin Long wrote:
> I guess you need to move up your memset(0) a little bit:
> 
> @@ -2427,6 +2443,7 @@ int netlink_rcv_skb(struct sk_buff *skb, int
> (*cb)(struct sk_buff *,
>                 nlh = nlmsg_hdr(skb);
>                 err = 0;
> 
> +               memset(&extack, 0, sizeof(extack));
>                 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
>                         return 0;
> 
> @@ -2438,7 +2455,6 @@ int netlink_rcv_skb(struct sk_buff *skb, int
> (*cb)(struct sk_buff *,
>                 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
>                         goto ack;
> 
> -               memset(&extack, 0, sizeof(extack));
>                 err = cb(skb, nlh, &extack);
> 
> So that 'goto ack's won't skip it. :-)
> 

you are correct. Can you submit a patch to do that?