netdev - Re: [PATCH] thunderbolt: xdomain: Avoid potential stack OOB read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Ya9Rsfos46i8Rcpc@lahna>
Date:   Tue, 7 Dec 2021 14:21:05 +0200
From:   Mika Westerberg <mika.westerberg@...ux.intel.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Andreas Noever <andreas.noever@...il.com>,
        Michael Jamet <michael.jamet@...el.com>,
        Yehezkel Bernat <YehezkelShB@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, linux-kernel@...r.kernel.org,
        linux-usb@...r.kernel.org, netdev@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH] thunderbolt: xdomain: Avoid potential stack OOB read

On Mon, Dec 06, 2021 at 10:34:13PM -0800, Kees Cook wrote:
> tb_xdp_properties_changed_request() was calling tb_xdp_handle_error() with
> a struct tb_xdp_properties_changed_response on the stack, which does not
> have the "error" field present when cast to struct tb_xdp_error_response.
> This was detected when building with -Warray-bounds:
> 
> drivers/thunderbolt/xdomain.c: In function 'tb_xdomain_properties_changed':
> drivers/thunderbolt/xdomain.c:226:22: error: array subscript 'const struct tb_xdp_error_response[0]' is partly outside array bounds of 'struct tb_xdp_properties_changed_response[1]' [-Werror=array-bounds]
>   226 |         switch (error->error) {
>       |                 ~~~~~^~~~~~~
> drivers/thunderbolt/xdomain.c:448:51: note: while referencing 'res'
>   448 |         struct tb_xdp_properties_changed_response res;
>       |                                                   ^~~
> 
> Add union containing struct tb_xdp_error_response to structures passed
> to tb_xdp_handle_error(), so that the "error" field will be present.
> 
> Signed-off-by: Kees Cook <keescook@...omium.org>

Applied, thanks!