linux-kernel - Re: DoS in lseek inodes with proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <fe27461f-69ef-41aa-bc8c-6e3fbb7f67ee@p183>
Date:   Mon, 18 Sep 2023 12:59:47 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     张子勋(Zhang Zixun) <zhangzixun1@...o.com>
Cc:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: DoS in lseek inodes with proc_ops

On Mon, Sep 18, 2023 at 07:39:51AM +0000, 张子勋(Zhang Zixun) wrote:
> Hi,
> There is a null pointer dereference DoS issue when I use lseek syscall to inode with proc_ops.
> I find the root cause is https://lore.kernel.org/all/YFYX0Bzwxlc7aBa%2F@localhost.localdomain/ .
> In this patch, the lseek syscall is set to mandatory. So, if proc_lseek is not set in proc_ops, pde->proc_ops->proc_lseek will get a null pointer.
> I want to know why all inode in proc need to set its own lseek, and why set default_llseek in pde_lseek isn’t a good idea?
> By the way, although every inode need set a lseek to use lseek syscall, lseek to a inode without lseek should get a fail return and the kernel should’t panic.

It removes 1 branch and make code smaller too.
You can switch to nonseekable_open() if you don't need lseeks.