linux-kernel - Re: [PATCH 4.14 17/89] futex: Prevent overflow by strengthen input validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 Jan 2018 15:06:12 +0100
From:   Jiri Slaby <jslaby@...e.cz>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Li Jinyue <lijinyue@...wei.com>, peterz@...radead.org,
        dvhart@...radead.org
Subject: Re: [PATCH 4.14 17/89] futex: Prevent overflow by strengthen input
 validation

On 01/25/2018, 03:03 PM, Thomas Gleixner wrote:
> On Thu, 25 Jan 2018, Jiri Slaby wrote:
>> On 01/22/2018, 09:44 AM, Greg Kroah-Hartman wrote:
>>> +	if (nr_wake < 0 || nr_requeue < 0)
>>> +		return -EINVAL;
>>
>> This breaks strace's test suite on 4.14.15 (and is present in upstream
>> obviously too):
>>     futex(0x7ff568b44ffc, 0x3, 0xfacefeed, 0xbadda7a0ca7b100d,
>> 0x7ff568b44ffc, 0x9caffee1) = -1: Invalid argument
> 
> And why the hell is strace expecting this to be valid?

You ought to ask somebody else, I was confused the very same way:

My FIX:
https://github.com/strace/strace/pull/16/commits/777587ea509481666274df88671949b390f05cc3

Their NACK:
https://github.com/strace/strace/pull/16#issuecomment-341614984

thanks,
-- 
js
suse labs