lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20170424.151532.982765506323365908.davem@davemloft.net>
Date:   Mon, 24 Apr 2017 15:15:32 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     bpoirier@...e.com
Cc:     pmenzel@...gen.mpg.de, jeffrey.t.kirsher@...el.com,
        netdev@...r.kernel.org, intel-wired-lan@...ts.osuosl.org,
        s.priebe@...fihost.ag
Subject: Re: [Intel-wired-lan] [PATCH 1/2] e1000e: Don't return
 uninitialized stats

From: Benjamin Poirier <bpoirier@...e.com>
Date: Mon, 24 Apr 2017 12:01:51 -0700

> On 2017/04/24 10:23, Paul Menzel wrote:
>> Dear Benjamin,
>> 
>> 
>> Thank you for your fix.
>> 
>> On 04/21/17 23:20, Benjamin Poirier wrote:
>> > Some statistics passed to ethtool are garbage because e1000e_get_stats64()
>> > doesn't write them, for example: tx_heartbeat_errors. This leaks kernel
>> > memory to userspace and confuses users.
>> 
>> Could you please give specific examples to reproduce the issue? That way
>> your fix can also be tested.
>> 
> 
> Some fields in e1000_get_ethtool_stats()'s net_stats are not initialized
> by e1000e_get_stats64(). The structure is allocated on the stack,
> therefore, the value of those fields depends on previous stack content;
> that in turns depends on kernel version, compiler and previous execution
> path.

I agree.

I read over these code paths earlier today and came to the same exact
conclusion.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ