linux-kernel - Re: [PATCH v1 2/2] ucounts: Move rlimit max values from ucounts max

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211203135453.ld2jblkd3xtlbgrv@example.org>
Date:   Fri, 3 Dec 2021 14:54:53 +0100
From:   Alexey Gladkov <legion@...linux.ru>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     kbuild@...ts.01.org, Alexey Gladkov <legion@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux Containers <containers@...ts.linux.dev>, lkp@...el.com,
        kbuild-all@...ts.01.org,
        "Eric W . Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH v1 2/2] ucounts: Move rlimit max values from ucounts max

On Fri, Dec 03, 2021 at 04:33:25PM +0300, Dan Carpenter wrote:
> Hi Alexey,
> 
> url:    https://github.com/0day-ci/linux/commits/Alexey-Gladkov/ucounts-Fix-rlimit-max-values-check/20211126-224059
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 136057256686de39cc3a07c2e39ef6bc43003ff6
> config: i386-randconfig-m021-20211126 (https://download.01.org/0day-ci/archive/20211128/202111280022.ugxpiKpA-lkp@intel.com/config)
> compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> 
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@...el.com>
> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> 
> smatch warnings:
> kernel/ucount.c:109 setup_userns_sysctls() error: buffer overflow 'ns->ucount_max' 10 <= 13
> 
> vim +109 kernel/ucount.c
> 
> dbec28460a89aa Eric W. Biederman 2016-07-30   98  bool setup_userns_sysctls(struct user_namespace *ns)
> dbec28460a89aa Eric W. Biederman 2016-07-30   99  {
> dbec28460a89aa Eric W. Biederman 2016-07-30  100  #ifdef CONFIG_SYSCTL
> dbec28460a89aa Eric W. Biederman 2016-07-30  101  	struct ctl_table *tbl;
> 0f538e3e712a51 Jan Kara          2020-04-07  102  
> 0f538e3e712a51 Jan Kara          2020-04-07  103  	BUILD_BUG_ON(ARRAY_SIZE(user_table) != UCOUNT_COUNTS + 1);
> dbec28460a89aa Eric W. Biederman 2016-07-30  104  	setup_sysctl_set(&ns->set, &set_root, set_is_seen);
> f6b2db1a3e8d14 Eric W. Biederman 2016-08-08  105  	tbl = kmemdup(user_table, sizeof(user_table), GFP_KERNEL);
> dbec28460a89aa Eric W. Biederman 2016-07-30  106  	if (tbl) {
> 25f9c0817c535a Eric W. Biederman 2016-08-08  107  		int i;
> 25f9c0817c535a Eric W. Biederman 2016-08-08  108  		for (i = 0; i < UCOUNT_COUNTS; i++) {
> 25f9c0817c535a Eric W. Biederman 2016-08-08 @109  			tbl[i].data = &ns->ucount_max[i];
> 
> The patch changes the size of ->ucount_max[] to MAX_PER_NAMESPACE_UCOUNTS
> but this loop still goes up to UCOUNT_COUNTS.
> 
> 25f9c0817c535a Eric W. Biederman 2016-08-08  110  		}
> f6b2db1a3e8d14 Eric W. Biederman 2016-08-08  111  		ns->sysctls = __register_sysctl_table(&ns->set, "user", tbl);
> dbec28460a89aa Eric W. Biederman 2016-07-30  112  	}
> dbec28460a89aa Eric W. Biederman 2016-07-30  113  	if (!ns->sysctls) {
> dbec28460a89aa Eric W. Biederman 2016-07-30  114  		kfree(tbl);
> dbec28460a89aa Eric W. Biederman 2016-07-30  115  		retire_sysctl_set(&ns->set);
> dbec28460a89aa Eric W. Biederman 2016-07-30  116  		return false;
> dbec28460a89aa Eric W. Biederman 2016-07-30  117  	}
> dbec28460a89aa Eric W. Biederman 2016-07-30  118  #endif
> dbec28460a89aa Eric W. Biederman 2016-07-30  119  	return true;
> dbec28460a89aa Eric W. Biederman 2016-07-30  120  }
> 
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
> 

Thanks! But a few days ago I already post a new version of this changeset
with fix:

https://lore.kernel.org/containers/24c87e225c7950bf2ea1ff4b4a8f237348808241.1638218242.git.legion@kernel.org/

-- 
Rgrds, legion