netdev - Re: [PATCH net] tipc: fix uninit-value in tipc_nl_compat_link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Jan 2019 14:52:20 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     David Miller <davem@...emloft.net>
Cc:     Ying Xue <ying.xue@...driver.com>, netdev <netdev@...r.kernel.org>,
        Jon Maloy <jon.maloy@...csson.com>,
        tipc-discussion@...ts.sourceforge.net,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: [PATCH net] tipc: fix uninit-value in tipc_nl_compat_link_set

On Mon, Jan 7, 2019 at 2:38 PM David Miller <davem@...emloft.net> wrote:
>
> From: Ying Xue <ying.xue@...driver.com>
> Date: Mon, 7 Jan 2019 19:29:52 +0800
>
> > This is because lc->name string is not validated before it's used.
>
> It looks like we have several situations like this, not just this one.
>
> For example, tipc_nl_compat_bearer_{enable,disable}() with b->name.
>
> Next, tipc_nl_compat_media_set() and tipc_nl_compat_bearer_set().
>
> On input, tipc_nl_compat_link_stat_dump() blindly does a strcmp()
> on one of these strings.
>
> In fact, this entire file is full of errors of this sort.
>
> Can you please address all of them, perhaps using a helper of
> some kind to consolidate the logic?
>
> Thank you.


There 9 uninits in tipc currently open  on syzbot. If you extend the
scope of this change, please update Reported-by tags accordingly.
Thanks

KMSAN: uninit-value in tipc_nl_compat_doit
https://syzkaller.appspot.com/bug?id=d64b3c48a3e81dca017e61a50d15880bc677cbb5

KMSAN: uninit-value in tipc_nl_compat_dumpit
https://syzkaller.appspot.com/bug?id=330d750e403fbaf78e3b631b389443c9153e3804

KMSAN: uninit-value in tipc_nl_compat_bearer_enable
https://syzkaller.appspot.com/bug?id=a9dce514eeddaa78ca8e04676c19097939db1fc5

KMSAN: uninit-value in tipc_nl_compat_name_table_dump
https://syzkaller.appspot.com/bug?id=c40c98888fb6ebdb3f66d99dfa2c1b8df9601a34

KMSAN: uninit-value in tipc_nl_compat_link_set (2)
https://syzkaller.appspot.com/bug?id=ab4ee03213b801410f0194d6b5435e8e3c95af94

KMSAN: uninit-value in __tipc_nl_bearer_enable
https://syzkaller.appspot.com/bug?id=bf95da1c68b889380395af19f1953e91b772d3ea

KMSAN: uninit-value in tipc_nl_compat_link_reset_stats
https://syzkaller.appspot.com/bug?id=a675bbf645ff6a5810e2af2f35752d93f80dd95b

KMSAN: uninit-value in tipc_subscrb_rcv_cb
https://syzkaller.appspot.com/bug?id=ec45249073777e4fc8fa9d8f1732f594bc2f4023

KMSAN: uninit-value in tipc_conn_rcv_sub
https://syzkaller.appspot.com/bug?id=0df95bc3a80b97dfd33dc7f47ebfd7802d03dfc3