linux-kernel - Re: [PATCH v6] kobject: Fix global-out-of-bounds in kobject_action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e27b1467-bf51-fc1f-b3ce-a45f06b5b795@huawei.com>
Date:   Tue, 23 May 2023 16:52:23 +0800
From:   Xia Fukun <xiafukun@...wei.com>
To:     Greg KH <gregkh@...uxfoundation.org>
CC:     <prajnoha@...hat.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v6] kobject: Fix global-out-of-bounds in
 kobject_action_type()

Gentle ping ...

On 2023/5/18 10:37, Xia Fukun wrote:
> On 2023/5/17 20:17, Greg KH wrote:
> 
>> And how was any of this tested?  Based on your prior submissions, we are
>> going to require some sort of proof.  What would you do if you were in
>> my position?
> 
> My testing method is to apply the patch, compile the kernel image,
> and start the QEMU virtual machine. Then compile and execute the code
> mentioned in the patch that triggers out-of-bounds issues.
> 
> In addition, the following operations will be performed to verify the
> functions mentioned by Peter Rajnoha <prajnoha@...hat.com>:
> 
> # echo "add fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc" >
> /sys/block/ram0/uevent
> 
> # udevadm monitor --kernel --env
> monitor will print the received events for:
> KERNEL - the kernel uevent
> 
> KERNEL[189.376386] add      /devices/virtual/block/ram0 (block)
> ACTION=add
> DEVPATH=/devices/virtual/block/ram0
> SUBSYSTEM=block
> SYNTH_UUID=fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed
> SYNTH_ARG_A=1
> SYNTH_ARG_B=abc
> DEVNAME=/dev/ram0
> DEVTYPE=disk
> DISKSEQ=14
> SEQNUM=3781
> MAJOR=1
> MINOR=0
> 
> Thank you for your suggestion. My submission was indeed negligent,
> and your guidance has benefited me greatly.

I have submitted v7 of the patch according to your suggestion and
tested it to ensure its functionality is correct.

Please take the time to review it.

Thank you very much.