linux-kernel - Re: [PATCH AUTOSEL 5.5 496/542] char: hpet: Fix out-of-bounds read bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200214214839.GE4193448@kroah.com>
Date:   Fri, 14 Feb 2020 16:48:39 -0500
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Eric Biggers <ebiggers@...nel.org>
Subject: Re: [PATCH AUTOSEL 5.5 496/542] char: hpet: Fix out-of-bounds read
 bug

On Fri, Feb 14, 2020 at 10:48:08AM -0500, Sasha Levin wrote:
> From: "Gustavo A. R. Silva" <gustavo@...eddedor.com>
> 
> [ Upstream commit 98c49f1746ac44ccc164e914b9a44183fad09f51 ]
> 
> Currently, there is an out-of-bounds read on array hpetp->hp_dev
> in the following for loop:
> 
> 870         for (i = 0; i < hdp->hd_nirqs; i++)
> 871                 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i];
> 
> This is due to the recent change from one-element array to
> flexible-array member in struct hpets:
> 
> 104 struct hpets {
> 	...
> 113         struct hpet_dev hp_dev[];
> 114 };
> 
> This change affected the total size of the dynamic memory
> allocation, decreasing it by one time the size of struct hpet_dev.
> 
> Fix this by adjusting the allocation size when calling
> struct_size().
> 
> Fixes: 987f028b8637c ("char: hpet: Use flexible-array member")
> Signed-off-by: Gustavo A. R. Silva <gustavo@...eddedor.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Acked-by: Eric Biggers <ebiggers@...nel.org>
> Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  drivers/char/hpet.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
> index aed2c45f7968c..ed3b7dab678db 100644
> --- a/drivers/char/hpet.c
> +++ b/drivers/char/hpet.c
> @@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp)
>  		return 0;
>  	}
>  
> -	hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1),
> +	hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs),
>  			GFP_KERNEL);
>  
>  	if (!hpetp)
> -- 
> 2.20.1
> 

Not needed unless you have the other patch that I asked you to drop
added :)