linux-kernel - Re: [PATCH] module: always complete idempotent loads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4650691f-a025-0a93-33ec-a99ff0ede157@oracle.com>
Date:   Tue, 4 Jul 2023 20:28:42 +0200
From:   Vegard Nossum <vegard.nossum@...cle.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Luis Chamberlain <mcgrof@...nel.org>,
        George Kennedy <george.kennedy@...cle.com>,
        linux-kernel@...r.kernel.org, linux-modules@...r.kernel.org,
        Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>,
        syzbot+9c2bdc9d24e4a7abe741@...kaller.appspotmail.com,
        Johan Hovold <johan@...nel.org>,
        Dan Williams <dan.j.williams@...el.com>,
        Rudi Heitbaum <rudi@...tbaum.com>,
        David Hildenbrand <david@...hat.com>
Subject: Re: [PATCH] module: always complete idempotent loads

On 7/4/23 15:37, Linus Torvalds wrote:
> On Tue, 4 Jul 2023 at 03:09, Vegard Nossum <vegard.nossum@...cle.com> wrote:
>>
>> Commit 9b9879fc0327 added a hashtable storing lists of concurrent module
>> loads. However, it didn't fix up all the error paths in
>> init_module_from_file(); this would lead to leaving the function while an
>> on-stack 'struct idempotent' element is still in the hash table, which
>> leads to all sorts of badness as spotted by syzkaller:
> 
> You are of course 100% right.
> 
> However, I'd rather just use a wrapper function and make this thing
> much clearer. Like I should have done originally.
> 
> So I'd be inclined towards a patch like the attached instead. Works for you?

Harshit tells me there's still a crash... and indeed, with your wrapped
version we call file_inode() on a NULL pointer before checking the
fdget() return value.

It's likely you already changed this with the f_mode changes I commented
on, so maybe it's no longer a problem, though.


Vegard