netdev - Re: [Intel-wired-lan] [PATCH 1/2] e1000e: Don't return uninitialized stats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170424.151532.982765506323365908.davem@davemloft.net>
Date:   Mon, 24 Apr 2017 15:15:32 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     bpoirier@...e.com
Cc:     pmenzel@...gen.mpg.de, jeffrey.t.kirsher@...el.com,
        netdev@...r.kernel.org, intel-wired-lan@...ts.osuosl.org,
        s.priebe@...fihost.ag
Subject: Re: [Intel-wired-lan] [PATCH 1/2] e1000e: Don't return
 uninitialized stats

From: Benjamin Poirier <bpoirier@...e.com>
Date: Mon, 24 Apr 2017 12:01:51 -0700

> On 2017/04/24 10:23, Paul Menzel wrote:
>> Dear Benjamin,
>> 
>> 
>> Thank you for your fix.
>> 
>> On 04/21/17 23:20, Benjamin Poirier wrote:
>> > Some statistics passed to ethtool are garbage because e1000e_get_stats64()
>> > doesn't write them, for example: tx_heartbeat_errors. This leaks kernel
>> > memory to userspace and confuses users.
>> 
>> Could you please give specific examples to reproduce the issue? That way
>> your fix can also be tested.
>> 
> 
> Some fields in e1000_get_ethtool_stats()'s net_stats are not initialized
> by e1000e_get_stats64(). The structure is allocated on the stack,
> therefore, the value of those fields depends on previous stack content;
> that in turns depends on kernel version, compiler and previous execution
> path.

I agree.

I read over these code paths earlier today and came to the same exact
conclusion.