linux-kernel - Re: [PATCH v3 05/15] habanalabs: add command buffer module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Feb 2019 13:06:39 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Oded Gabbay <oded.gabbay@...il.com>
Cc:     linux-kernel@...r.kernel.org, olof@...om.net, rppt@...ux.ibm.com,
        ogabbay@...ana.ai, arnd@...db.de, joe@...ches.com
Subject: Re: [PATCH v3 05/15] habanalabs: add command buffer module

On Mon, Feb 04, 2019 at 10:32:44PM +0200, Oded Gabbay wrote:
> +int hl_cb_ioctl(struct hl_fpriv *hpriv, void *data)
> +{
> +	union hl_cb_args *args = data;
> +	struct hl_device *hdev = hpriv->hdev;
> +	u64 handle;
> +	int rc;
> +
> +	switch (args->in.op) {
> +	case HL_CB_OP_CREATE:
> +		rc = hl_cb_create(hdev, &hpriv->cb_mgr, args->in.cb_size,
> +					&handle, hpriv->ctx->asid);

so cb_size comes from userspace, ok, you check for the value to be too
small, but not too big.  That means someone can try to allocate too much
memory, possibly crashing things, not good :(


> +		memset(args, 0, sizeof(*args));
> +		args->out.cb_handle = handle;
> +		break;
> +	case HL_CB_OP_DESTROY:
> +		rc = hl_cb_destroy(hdev, &hpriv->cb_mgr,
> +					args->in.cb_handle);
> +		memset(args, 0, sizeof(*args));

Why zero this if it's not copied back to userspace?



> +		break;
> +	default:
> +		rc = -EINVAL;

-ENOTTY is normally the "invalid ioctl value", right?

> +		break;
> +	}
> +
> +	return rc;
> +}

thanks,

greg k-h