linux-kernel - 回复: 回复: linux-next: build failure after merge of the char-misc tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <BL1PR11MB59798DB1C2D7B2B2988BE2DB8643A@BL1PR11MB5979.namprd11.prod.outlook.com>
Date: Thu, 3 Jul 2025 09:44:13 +0000
From: "Xu, Lizhi" <Lizhi.Xu@...driver.com>
To: Greg KH <greg@...ah.com>
CC: Stephen Rothwell <sfr@...b.auug.org.au>, Arnd Bergmann <arnd@...db.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing
 List <linux-next@...r.kernel.org>
Subject:
 回复: 回复: linux-next: build failure after merge of the char-misc tree

Perhaps you can focus on "struct vmci_event_ctx", whose members have already clearly defined which are the payloads.
On the other hand, the purpose of the patch is to prevent the data in "struct vmci_event_ctx" from being initialized before the datagram is sent, thus preventing the uninitialized data from leaking to user space.

________________________________________
发件人: Greg KH <greg@...ah.com>
发送时间: 2025年7月3日 17:28
收件人: Xu, Lizhi
抄送: Stephen Rothwell; Arnd Bergmann; Linux Kernel Mailing List; Linux Next Mailing List
主题: Re: 回复: linux-next: build failure after merge of the char-misc tree

CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.

On Thu, Jul 03, 2025 at 08:55:31AM +0000, Xu, Lizhi wrote:
> Greg,
>
> In ctx_fire_notification(), the following code can fully prove that the header is followed by the payload.
> ev.msg.hdr.payload_size = sizeof(ev) - sizeof(ev.msg.hdr);
>
> I sent a second version of the patch, did you notice it? It can solve the problem reported by Stephen Rothwell.
>
> V2 Patch: https://lore.kernel.org/all/20250703075334.856445-1-lizhi.xu@windriver.com

I see that now, thank you.

But, if I had not reverted your previous one, that patch would not have
applied :(

Also, how can you "guarantee" that there is no padding between those
structure fields so that your "pointer math" is correct here?  Why not
fix this up properly to use the correct way to define that you have a
"payload" at the end of a structure, AND properly define how large that
payload is with the specific variable that describes that?  By doing
that, then the compiler can check when things violate those rules going
forward.

thanks,

greg k-h