netdev - Re: [patch] netlink: fix a limit in NETLINK_LIST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 13 Nov 2015 15:43:31 +0100
From:	David Herrmann <dh.herrmann@...il.com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Thomas Graf <tgraf@...g.ch>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Daniel Borkmann <daniel@...earbox.net>,
	Johannes Berg <johannes.berg@...el.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Nicolas Dichtel <nicolas.dichtel@...nd.com>,
	Florian Westphal <fw@...len.de>,
	netdev <netdev@...r.kernel.org>,
	"kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>
Subject: Re: [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS

Hi

On Fri, Nov 13, 2015 at 3:20 PM, Dan Carpenter <dan.carpenter@...cle.com> wrote:
> This condition doesn't work when len is smaller than expected and not a
> multiple of 4.  In that situation "len - pos" is negative and type
> promoted to a high unsigned value and we do not break out of the loop.
> It causes the program calling it to crash.

Could you give an example how this can happen? The loop-invariant
should be "len >= pos", as such, this shouldn't happen. "pos" starts
out as 0, "len" is guaranteed to be >=0. "pos" is only incremented by
4, if "len - pos >= 4".

What am I missing?

Thanks
David

> Fixes: b42be38b2778 ('netlink: add API to retrieve all group memberships')
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
>
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index 59651af..76a8466 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -2373,7 +2373,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
>                 err = 0;
>                 netlink_lock_table();
>                 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
> -                       if (len - pos < sizeof(u32))
> +                       if (len < pos + sizeof(u32))
>                                 break;
>
>                         idx = pos / sizeof(unsigned long);
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html