lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20231013-0fb230037c78d2c397e691c7@orel>
Date:   Fri, 13 Oct 2023 08:30:04 +0200
From:   Andrew Jones <ajones@...tanamicro.com>
To:     Mark Brown <broonie@...nel.org>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, Shuah Khan <shuah@...nel.org>,
        Haibo Xu <haibo1.xu@...el.com>,
        Anup Patel <anup@...infault.org>, kvm@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] KVM: selftests: Initialise dynamically allocated
 configuration names

On Fri, Oct 13, 2023 at 12:19:30AM +0100, Mark Brown wrote:
> When we dynamically generate a name for a configuration in get-reg-list
> we use strcat() to append to a buffer allocated using malloc() but we
> never initialise that buffer. Since malloc() offers no guarantees
> regarding the contents of the memory it returns this can lead to us
> corrupting, and likely overflowing, the buffer:
> 
>   vregs: PASS
>   vregs+pmu: PASS
>   sve: PASS
>   sve+pmu: PASS
>   vregs+pauth_address+pauth_generic: PASS
>   X�vr+gspauth_addre+spauth_generi+pmu: PASS
> 
> Initialise the buffer to an empty string to avoid this.
> 
> Fixes: 17da79e009c37 ("KVM: arm64: selftests: Split get-reg-list test code")

Doh, this is an embarrassing bug. But the patch above just moves the buggy
code. I'm still guilty for the bug, but the fixes tag should be

Fixes: 2f9ace5d4557 ("KVM: arm64: selftests: get-reg-list: Introduce vcpu configs")

> Signed-off-by: Mark Brown <broonie@...nel.org>
> ---
>  tools/testing/selftests/kvm/get-reg-list.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/tools/testing/selftests/kvm/get-reg-list.c b/tools/testing/selftests/kvm/get-reg-list.c
> index be7bf5224434..dd62a6976c0d 100644
> --- a/tools/testing/selftests/kvm/get-reg-list.c
> +++ b/tools/testing/selftests/kvm/get-reg-list.c
> @@ -67,6 +67,7 @@ static const char *config_name(struct vcpu_reg_list *c)
>  
>  	c->name = malloc(len);
>  
> +	c->name[0] = '\0';
>  	len = 0;
>  	for_each_sublist(c, s) {
>  		if (!strcmp(s->name, "base"))
> 
> ---
> base-commit: 6465e260f48790807eef06b583b38ca9789b6072
> change-id: 20231012-kvm-get-reg-list-str-init-76c8ed4e19d6
>

Other than the tag,

Reviewed-by: Andrew Jones <ajones@...tanamicro.com>

Thanks,
drew

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ