linux-kernel - Re: KASAN: slab-out-of-bounds Read in build_audio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 28 Oct 2019 15:42:44 +0100
From:   Takashi Iwai <tiwai@...e.de>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     syzbot <syzbot+0620f79a1978b1133fd7@...kaller.appspotmail.com>,
        alsa-devel@...a-project.org, andreyknvl@...gle.com,
        benquike@...il.com, g@...vu, linux-kernel@...r.kernel.org,
        linux-usb@...r.kernel.org, perex@...ex.cz, rfontana@...hat.com,
        syzkaller-bugs@...glegroups.com, tiwai@...e.com,
        yuehaibing@...wei.com
Subject: Re: KASAN: slab-out-of-bounds Read in build_audio_procunit

On Mon, 28 Oct 2019 15:34:06 +0100,
Dan Carpenter wrote:
> 
> I wish that this could have been detected with static analysis...
> 
> On Tue, Oct 22, 2019 at 05:45:14PM +0200, Takashi Iwai wrote:
> > diff --git a/sound/usb/validate.c b/sound/usb/validate.c
> > index 3c8f73a0eb12..a5e584b60dcd 100644
> > --- a/sound/usb/validate.c
> > +++ b/sound/usb/validate.c
> > @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p,
> >  
> >  	if (d->bLength < sizeof(*d))
>             ^^^^^^^^^^^^^^^^^^^^^^^
> So we know that d->bLength is >= 10.
> 
> >  		return false;
> > -	len = d->bLength < sizeof(*d) + d->bNrInPins;
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Len is 1 or 0.
> 
> > +	len = sizeof(*d) + d->bNrInPins;
> >  	if (d->bLength < len)
>             ^^^^^^^^^^^^^^^^
> 
> So this condition can't be false.
> 
> >  		return false;
> 
> But it just makes this return into dead code and we have a lot of dead
> code paths in the kernel so it doesn't make sense to generate a warning.
> ...  I don't know if I have a solution.
> 
> Maybe some day we will have a vim pluggin which will highlight all the
> dead paths and someone would notice that it that way.

That'd be awesome :)  Of even a simple checker code that can run in
the git commit hook should suffice for careless maintainers like me.


thanks,

Takashi