linux-kernel - Re: [PATCH] security: do not leak information in ioctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eec2efee-1153-8d8e-77c2-96156733a0c6@redhat.com>
Date:   Mon, 11 Apr 2022 09:31:20 -0700
From:   Tom Rix <trix@...hat.com>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     tim@...erelk.net, axboe@...nel.dk, jejb@...ux.ibm.com,
        martin.petersen@...cle.com, nathan@...nel.org,
        ndesaulniers@...gle.com, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
        llvm@...ts.linux.dev
Subject: Re: [PATCH] security: do not leak information in ioctl


On 4/11/22 8:07 AM, Christoph Hellwig wrote:
> Wrong subject prefix, and this really should be split into one patch for
> pcd and one for sr.
ok i will split
> The sr prt looks sensible to me.  But for pcd why can't you just
> initialize buffer using
>
> 	char buffer[32] = { };
>
> and be done with it?

The failure can happen in the transfer loop, so some of the data will 
not be zero.

And checking status should be done.

zero-ing is because i am paranoid.

Tom

>