linux-kernel - Re: [PATCH] smackfs: restrict bytes count in smackfs write functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 26 Jan 2021 07:42:12 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Casey Schaufler <casey@...aufler-ca.com>,
        Sabyrzhan Tasbolatov <snovitoll@...il.com>
Cc:     jmorris@...ei.org, serge@...lyn.com, andreyknvl@...gle.com,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        syzbot+a71a442385a0b2815497@...kaller.appspotmail.com,
        Michal Hocko <mhocko@...e.com>
Subject: Re: [PATCH] smackfs: restrict bytes count in smackfs write functions

On 2021/01/26 3:08, Casey Schaufler wrote:
> On 1/24/2021 6:36 AM, Sabyrzhan Tasbolatov wrote:
>> syzbot found WARNINGs in several smackfs write operations where
>> bytes count is passed to memdup_user_nul which exceeds
>> GFP MAX_ORDER. Check count size if bigger SMK_LONGLABEL,
>> for smk_write_syslog if bigger than PAGE_SIZE - 1.
>>
>> Reported-by: syzbot+a71a442385a0b2815497@...kaller.appspotmail.com
>> Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@...il.com>
> 
> Thank you for the patch. Unfortunately, SMK_LONGLABEL isn't
> the right value in some of these cases. 
> 

Since it uses sscanf(), I think that whitespaces must be excluded from upper limit
check. I'm proposing adding __GFP_NOWARM on the memdup_user_nul() side at
https://lkml.kernel.org/r/20210120103436.11830-1-penguin-kernel@I-love.SAKURA.ne.jp .