linux-kernel - Re: [PATCH v4] sysctl: move the extra1/2 boundary check of u8 to sysctl_check_table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 3 May 2024 15:18:57 +0200
From: Joel Granados <j.granados@...sung.com>
To: Wen Yang <wen.yang@...ux.dev>
CC: "Eric W . Biederman" <ebiederm@...ssion.com>, Luis Chamberlain
	<mcgrof@...nel.org>, Kees Cook <keescook@...omium.org>, Christian Brauner
	<brauner@...nel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] sysctl: move the extra1/2 boundary check of u8 to
 sysctl_check_table_array

On Fri, Apr 19, 2024 at 11:36:39AM +0800, Wen Yang wrote:
> Move boundary checking for proc_dou8ved_minmax into module loading, thereby
> reporting errors in advance. And add a kunit test case ensuring the
> boundary check is done correctly.
> 
...
> +	KUNIT_CASE(sysctl_test_register_sysctl_sz_invalid_extra_value),
>  	{}
>  };
>  
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index e0b917328cf9..c0a1164eaf59 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -977,16 +977,10 @@ int proc_dou8vec_minmax(struct ctl_table *table, int write,
>  	if (table->maxlen != sizeof(u8))
>  		return -EINVAL;
>  
> -	if (table->extra1) {
> +	if (table->extra1)
>  		min = *(unsigned int *) table->extra1;
> -		if (min > 255U)
> -			return -EINVAL;
> -	}
> -	if (table->extra2) {
> +	if (table->extra2)
>  		max = *(unsigned int *) table->extra2;
> -		if (max > 255U)
> -			return -EINVAL;
> -	}
>  
>  	tmp = *table;
>  
> -- 
> 2.25.1
> 

Queueing this up for 6.11. I'll put it into sysclt-testing.

Reviewed-by: Joel Granados <j.granados@...sung.com>
-- 

Joel Granados

Download attachment "signature.asc" of type "application/pgp-signature" (660 bytes)