linux-kernel - RE: [PATCH 4.19 051/168] dyndbg: fix a BUG_ON in ddebug_describe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 18 Aug 2020 10:51:10 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Pavel Machek' <pavel@...x.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "jbaron@...mai.com" <jbaron@...mai.com>,
        Jim Cromie <jim.cromie@...il.com>,
        Sasha Levin <sashal@...nel.org>
Subject: RE: [PATCH 4.19 051/168] dyndbg: fix a BUG_ON in
 ddebug_describe_flags

From: Pavel Machek
> Sent: 18 August 2020 10:51
> 
> On Mon 2020-08-17 17:16:22, Greg Kroah-Hartman wrote:
> > From: Jim Cromie <jim.cromie@...il.com>
> >
> > [ Upstream commit f678ce8cc3cb2ad29df75d8824c74f36398ba871 ]
> >
> > ddebug_describe_flags() currently fills a caller provided string buffer,
> > after testing its size (also passed) in a BUG_ON.  Fix this by
> > replacing them with a known-big-enough string buffer wrapped in a
> > struct, and passing that instead.
> >
> > Also simplify ddebug_describe_flags() flags parameter from a struct to
> > a member in that struct, and hoist the member deref up to the caller.
> > This makes the function reusable (soon) where flags are unpacked.
> 
> Original code was correct, passing explicit size, this passes strange
> structure. BUG_ON can never trigger in the origianl code, so this is
> not a bugfix.

Embedding the char[] in a struct can be used to ensure that
an incorrect size isn't passed.

But it still doesn't make it any more correct to not
check the actual buffer won't be overrun.

In this case the code is still assuming that the buffer
is large enough.

Odd code changes could (probably) still break it.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)