lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20241008135105.7426-1-pvmohammedanees2003@gmail.com>
Date: Tue,  8 Oct 2024 19:21:05 +0530
From: Mohammed Anees <pvmohammedanees2003@...il.com>
To: lihongbo22@...wei.com
Cc: kent.overstreet@...ux.dev,
	linux-bcachefs@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	pvmohammedanees2003@...il.com,
	syzbot+37186860aa7812b331d5@...kaller.appspotmail.com
Subject: Re: [PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

Hi Hongbo,

> As definition, max is the right bound for value. opt->max - 1 is valid. 
> May be you should remove the equals sign.

This is not true, max is not the right upper bound when it comes to
this but rather the size of the array instead, therefore opt->max - 1
is where we should stop.

const struct bch_option bch2_opt_table[] = {
#define OPT_BOOL()		.type = BCH_OPT_BOOL, .min = 0, .max = 2
#define OPT_UINT(_min, _max)	.type = BCH_OPT_UINT,			\
				.min = _min, .max = _max
#define OPT_STR(_choices)	.type = BCH_OPT_STR,			\
				.min = 0, .max = ARRAY_SIZE(_choices),	\
				.choices = _choices
...

Here if you look at OPT_STR you see that it is indeed the size
of the array.

> It should be no problem to just solve this null pointer issue() (How is 
> this stack triggered, may be I lost something.), but this should be a 

The reason this is triggered is because in bch2_opt_to_text,
the parameter v passed is beyond the number of options available 
to Opt_str_hash.

#define BCH_STR_HASH_OPTS()		\
	x(crc32c,		0)	\
	x(crc64,		1)	\
	x(siphash,		2)

Passing a value v of 3 attempts to access a non-existent fourth element.
This value v corresponds to str_hash in the bch_opts structure within the 
bch_fs struct. Since print_mount_opts checks each option, it seems 
appropriate to add the validation there. Please let me know if 
I've misunderstood anything.

Thanks!


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ