linux-kernel - Re: [PATCH] ath9k/eeprom: Use scnprintf instead of snprintf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190204155320.39CD9606AC@smtp.codeaurora.org>
Date:   Mon,  4 Feb 2019 15:53:20 +0000 (UTC)
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Willy Tarreau <w@....eu>, Silvio Cesare <silvio.cesare@...il.com>,
        QCA ath9k Development <ath9k-devel@....qualcomm.com>,
        linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ath9k/eeprom: Use scnprintf instead of snprintf

Kees Cook <keescook@...omium.org> wrote:

> Change snprintf to scnprintf. There are generally two cases where using
> snprintf causes problems.
> 
> 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)  In this case,
> if snprintf would have written more characters than what the buffer
> size (SIZE) is, then size will end up larger than SIZE. In later uses
> of snprintf, SIZE - size will result in a negative number, leading to
> problems. Note that size might already be too large by using size =
> snprintf before the code reaches a case of size += snprintf.
> 
> 2) If size is ultimately used as a length parameter for a copy back to
> user space, then it will potentially allow for a buffer overflow and
> information disclosure when size is greater than SIZE. When the size is
> used to index the buffer directly, we can have memory corruption. This
> also means when size = snprintf... is used, it may also cause problems
> since size may become large. Copying to userspace is mitigated by the
> HARDENED_USERCOPY kernel configuration.
> 
> The solution to these issues is to use scnprintf which returns the number
> of characters actually written to the buffer, so the size variable will
> never exceed SIZE.
> 
> Cc: Willy Tarreau <w@....eu>
> Cc: Silvio Cesare <silvio.cesare@...il.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> Signed-off-by: Kalle Valo <kvalo@...eaurora.org>

Patch applied to ath-next branch of ath.git, thanks.

4b6e9f3fe1d8 ath9k: eeprom: Use scnprintf instead of snprintf

-- 
https://patchwork.kernel.org/patch/10765259/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches