netdev - Re: [Patch net] net_sched: keep alloc_hash updated after hash allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200314.204332.34522326258762384.davem@davemloft.net>
Date:   Sat, 14 Mar 2020 20:43:32 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org,
        syzbot+dcc34d54d68ef7d2d53d@...kaller.appspotmail.com,
        syzbot+c72da7b9ed57cde6fca2@...kaller.appspotmail.com,
        jhs@...atatu.com, jiri@...nulli.us
Subject: Re: [Patch net] net_sched: keep alloc_hash updated after hash
 allocation

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Wed, 11 Mar 2020 22:42:28 -0700

> In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
> I moved cp->hash calculation before the first
> tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
> This difference could lead to another out of bound access.
> 
> cp->alloc_hash should always be the size allocated, we should
> update it after this tcindex_alloc_perfect_hash().
> 
> Reported-and-tested-by: syzbot+dcc34d54d68ef7d2d53d@...kaller.appspotmail.com
> Reported-and-tested-by: syzbot+c72da7b9ed57cde6fca2@...kaller.appspotmail.com
> Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Jiri Pirko <jiri@...nulli.us>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Also applied and queued up for -stable, thanks.