linux-kernel - RE: [PATCH 04/20] dlb2: add device ioctl layer and first 4 ioctls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Jul 2020 18:20:06 +0000
From:   "Eads, Gage" <gage.eads@...el.com>
To:     Randy Dunlap <rdunlap@...radead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "arnd@...db.de" <arnd@...db.de>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:     "Karlsson, Magnus" <magnus.karlsson@...el.com>,
        "Topel, Bjorn" <bjorn.topel@...el.com>
Subject: RE: [PATCH 04/20] dlb2: add device ioctl layer and first 4 ioctls



> -----Original Message-----
> From: Randy Dunlap <rdunlap@...radead.org>
> Sent: Sunday, July 12, 2020 9:54 AM
> To: Eads, Gage <gage.eads@...el.com>; linux-kernel@...r.kernel.org;
> arnd@...db.de; gregkh@...uxfoundation.org
> Cc: Karlsson, Magnus <magnus.karlsson@...el.com>; Topel, Bjorn
> <bjorn.topel@...el.com>
> Subject: Re: [PATCH 04/20] dlb2: add device ioctl layer and first 4 ioctls
> 
> On 7/12/20 6:43 AM, Gage Eads wrote:
> > +int dlb2_ioctl_dispatcher(struct dlb2_dev *dev,
> > +			  unsigned int cmd,
> > +			  unsigned long arg)
> > +{
> > +	u16 sz = _IOC_SIZE(cmd);
> > +
> > +	if (_IOC_NR(cmd) >= NUM_DLB2_CMD) {
> 
> Does this bounds check need to use array_index_nospec() from
> <linux/nospec.h> ?
> 
> > +		dev_err(dev->dlb2_device,
> > +			"[%s()] Unexpected DLB command %d\n",
> > +			__func__, _IOC_NR(cmd));
> > +		return -1;
> > +	}
> > +
> > +	return dlb2_ioctl_callback_fns[_IOC_NR(cmd)](dev, arg, sz); }
> 
> I don't know if it needs to or not. I just want to make sure that you or
> someone has thought about it.

Thanks for catching this -- it does. Per Arnd's suggestion, I'm going to convert this to a switch statement and avoid the index altogether.

Thanks,
Gage

> 
> --
> ~Randy