linux-kernel - [PATCH v2] fs/proc: timers -- Test for potential index overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Nov 2018 14:31:53 +0300
From:   Cyrill Gorcunov <gorcunov@...il.com>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Andrey Vagin <avagin@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>
Subject: [PATCH v2] fs/proc: timers -- Test for potential index overflow

When showing timer's notify symbolic name make sure we never fetch a value
sitting outside of the names array. Though the former issue displaying
timer->it_sigev_notify has been fixed by Thomas in commit cef31d9af9082434,
better to make sure we won't hit it again on furher modifications.

v2: Use explicit index overflow test (by tglx@). Since
    it should never happen add warn-once to notify.

Cc: Andrey Vagin <avagin@...il.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Ingo Molnar <mingo@...nel.org>
Signed-off-by: Cyrill Gorcunov <gorcunov@...il.com>
---
 fs/proc/base.c |    6 ++++++
 1 file changed, 6 insertions(+)

Index: linux-ml.git/fs/proc/base.c
===================================================================
--- linux-ml.git.orig/fs/proc/base.c
+++ linux-ml.git/fs/proc/base.c
@@ -2297,6 +2297,12 @@ static int show_timer(struct seq_file *m
 	timer = list_entry((struct list_head *)v, struct k_itimer, list);
 	notify = timer->it_sigev_notify;
 
+	if ((notify & ~SIGEV_THREAD_ID) >= ARRAY_SIZE(nstr)) {
+		WARN_ONCE(1, "timer: Bad signal notify mode %#x on ID %d\n",
+			  notify, timer->it_id);
+		return -EINVAL;
+	}
+
 	seq_printf(m, "ID: %d\n", timer->it_id);
 	seq_printf(m, "signal: %d/%px\n",
 		   timer->sigq->info.si_signo,