netdev - Re: [PATCH] netlink: fix state reallocation in policy export

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b9ffb2eedde8e6e3c4c2d6ef44c262e06373d8b1.camel@sipsolutions.net>
Date:   Wed, 19 Aug 2020 21:52:15 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH] netlink: fix state reallocation in policy export

On Wed, 2020-08-19 at 12:10 -0700, Jakub Kicinski wrote:

> > +	memset(&state->policies[state->n_alloc], 0,
> > +	       sizeof(state->policies[0]) * (n_alloc - state->n_alloc));
> 
> [flex_]array_size() ? To avoid the inevitable follow up from a bot..

Yeah, hmm.

I suppose you know this but we can't really overflow anything here since
all of the factors are kernel controlled; you can't really have enough
policies in memory to overflow this, I'd think. We walk the constant
policies and their nested policies - nl80211 is a *heavy* user and only
recently went >10 policies linked together (triggering the bug)...

Really what we need is kzrealloc() ;-)

I'll send a v2 using flex_array_size(), it doesn't look any worse and I
don't care about the overflow check either since it's not at all a fast-
path.

johannes