lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Thu, 16 May 2019 22:37:30 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Alexander Potapenko <glider@...gle.com>
Cc:     syzbot <syzbot+1018d578c410f9f37261@...kaller.appspotmail.com>,
        James Morris <jmorris@...ei.org>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        takedakn@...data.co.jp
Subject: Re: KMSAN: uninit-value in tomoyo_check_inet_address

On 2019/05/16 22:19, Alexander Potapenko wrote:
>> commit e6193f78bb689f3f424559bb45f4a091c8b314df
>> Author: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>> Date:   Fri Apr 12 19:59:36 2019 +0900
>>
>>     tomoyo: Check address length before reading address family
>>
>>     KMSAN will complain if valid address length passed to bind()/connect()/
>>     sendmsg() is shorter than sizeof("struct sockaddr"->sa_family) bytes.
>>
>>     Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>>     Signed-off-by: James Morris <jamorris@...ux.microsoft.com>
> Apparently the fix didn't make it to 5.1, I'll cherry-pick it to KMSAN tree.

Together with three more patches listed bottom, please.

> OOC, how did you know about this bug?

I did a tree-wide check when writing a patch for

  KMSAN: uninit-value in rds_bind
  KMSAN: uninit-value in rds_connect

reports. Patches for LSM part just did not make it to 5.1.



commit b9ef5513c99bf9c8bfd9c9e8051b67f52b2dee1e
Author: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Date:   Fri Apr 12 19:59:35 2019 +0900

    smack: Check address length before reading address family

commit 619ae03e922b65a1a5d4269ceae1e9e13a058d6b
Author: Casey Schaufler <casey@...aufler-ca.com>
Date:   Tue Apr 30 14:13:32 2019 -0700

    Smack: Fix kbuild reported build error

commit c750e6929d3c76d13d1d0ba475989d6dd74785d5
Author: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Date:   Fri Apr 12 19:59:34 2019 +0900

    selinux: Check address length before reading address family

Powered by blists - more mailing lists