lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 19 Aug 2020 21:52:15 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH] netlink: fix state reallocation in policy export

On Wed, 2020-08-19 at 12:10 -0700, Jakub Kicinski wrote:
 
> > +	memset(&state->policies[state->n_alloc], 0,
> > +	       sizeof(state->policies[0]) * (n_alloc - state->n_alloc));
> 
> [flex_]array_size() ? To avoid the inevitable follow up from a bot..

Yeah, hmm.

I suppose you know this but we can't really overflow anything here since
all of the factors are kernel controlled; you can't really have enough
policies in memory to overflow this, I'd think. We walk the constant
policies and their nested policies - nl80211 is a *heavy* user and only
recently went >10 policies linked together (triggering the bug)...

Really what we need is kzrealloc() ;-)

I'll send a v2 using flex_array_size(), it doesn't look any worse and I
don't care about the overflow check either since it's not at all a fast-
path.

johannes

Powered by blists - more mailing lists