netdev - two bogus patches arising from CVE-2019-12381

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200401105452.1376920.qmail@chch.co.uk>
Date:   1 Apr 2020 10:54:52 -0000
From:   Charles Bryant <ch.4g7vxy-nbkl8p@...h.co.uk>
To:     netdev@...r.kernel.org
Subject: two bogus patches arising from CVE-2019-12381

I believe two patches from last year are mistaken. They are:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=95baa60a0da80a0143e3ddd4d3725758b4513825

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=425aa0e1d01513437668fa3d4a971168bbaa8515

Both of these make a function return immediately with ENOMEM if a kalloc()
fails.  However in each case the function already correctly handled
allocation failure later on. Furthermore, by making them exit early
on allocation failure, it (very slightly) makes them worse as in some
cases they might have correctly returned EADDRINUSE and not needed the
allocated memory.

I think, therefore, that these changes should be reverted.
-- 
Charles Bryant