netdev - Re: [PATCH] net/tun: fix ioctl() based info leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 30 Jul 2012 07:38:37 +0200
From:	Mathias Krause <minipli@...glemail.com>
To:	richard -rw- weinberger <richard.weinberger@...il.com>
Cc:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] net/tun: fix ioctl() based info leaks

On Mon, Jul 30, 2012 at 1:11 AM, richard -rw- weinberger
<richard.weinberger@...il.com> wrote:
> On Sun, Jul 29, 2012 at 10:58 PM, Mathias Krause <minipli@...glemail.com> wrote:
>> -       if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
>> +       if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
>>                 if (copy_from_user(&ifr, argp, ifreq_len))
>>                         return -EFAULT;
>> +       } else {
>> +               memset(&ifr, 0, sizeof(ifr));
>> +       }
>>
>>         if (cmd == TUNGETFEATURES) {
>>                 /* Currently this just means: "what IFF flags are valid?".
>
> The fix makes sense to me.
>
> Beside of the fix, why are you adding braces to if and else?

The pair of braces around the "if" is needed to attach the "else"
branch to the right "if". The braces around the "else" are just for
consistency.

> We don't use braces on single statements.

Even tun.c isn't consistently following this rule but I'll send a new
patch without the "else" braces.

Thanks,
Mathias
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html