linux-kernel - Re: [REGRESSION][BISECTED] erroneous buffer overflow detected in bch2_xattr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202505011109.046221D857@keescook>
Date: Thu, 1 May 2025 11:10:43 -0700
From: Kees Cook <kees@...nel.org>
To: Jan Hendrik Farr <kernel@...rr.cc>
Cc: Alan Huang <mmpgouride@...il.com>, kent.overstreet@...ux.dev,
	Thorsten Blum <thorsten.blum@...lux.com>,
	Miguel Ojeda <miguel.ojeda.sandonis@...il.com>,
	Nathan Chancellor <nathan@...nel.org>,
	Bill Wendling <morbo@...gle.com>, regressions@...ts.linux.dev,
	linux-bcachefs@...r.kernel.org, linux-hardening@...r.kernel.org,
	LKML <linux-kernel@...r.kernel.org>, ardb@...nel.org,
	ojeda@...nel.org
Subject: Re: [REGRESSION][BISECTED] erroneous buffer overflow detected in
 bch2_xattr_validate

On Thu, May 01, 2025 at 07:58:53PM +0200, Jan Hendrik Farr wrote:
> So let's say you have a simple struct like so:
> 
> struct foo{
> 	int val_len;
> 	char val[] __counted_by(val_len);
> }
> 
> If val_len is 10 then foo->val[10] will be considered out of bounds.
> Even if you did a malloc for enough space.

Correct. The "counted_by" attribute takes precedence over the "alloc_size"
attribute (which is also generally limited only to the function-scope
where the allocation takes place).

-- 
Kees Cook