netdev - Re: [PATCH net 1/1] i40e: fix PTP pins verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f525d5b887888f6c00633d4187836da0fb31f2cf.camel@redhat.com>
Date:   Thu, 27 Apr 2023 12:24:32 +0200
From:   Paolo Abeni <pabeni@...hat.com>
To:     Richard Cochran <richardcochran@...il.com>,
        Leon Romanovsky <leon@...nel.org>
Cc:     Tony Nguyen <anthony.l.nguyen@...el.com>, davem@...emloft.net,
        kuba@...nel.org, edumazet@...gle.com, netdev@...r.kernel.org,
        Andrii Staikov <andrii.staikov@...el.com>,
        Sunitha Mekala <sunithax.d.mekala@...el.com>
Subject: Re: [PATCH net 1/1] i40e: fix PTP pins verification

On Wed, 2023-04-26 at 06:52 -0700, Richard Cochran wrote:
> On Wed, Apr 26, 2023 at 10:18:12AM +0300, Leon Romanovsky wrote:
> > On Tue, Apr 25, 2023 at 10:04:06AM -0700, Tony Nguyen wrote:
> > > From: Andrii Staikov <andrii.staikov@...el.com>
> > > 
> > > Fix PTP pins verification not to contain tainted arguments. As a new PTP
> > > pins configuration is provided by a user, it may contain tainted
> > > arguments that are out of bounds for the list of possible values that can
> > > lead to a potential security threat. Change pin's state name from 'invalid'
> > > to 'empty' for more clarification.
> > 
> > And why isn't this handled in upper layer which responsible to get
> > user input?
> 
> It is.
> 
> long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
> {
> 	...
> 
> 	switch (cmd) {
> 
> 	case PTP_PIN_SETFUNC:
> 	case PTP_PIN_SETFUNC2:
> 		if (copy_from_user(&pd, (void __user *)arg, sizeof(pd))) {
> 			err = -EFAULT;
> 			break;
> 		}
> 		...
> 
> 		pin_index = pd.index;
> 		if (pin_index >= ops->n_pins) {
> 			err = -EINVAL;
> 			break;
> 		}
> 
> 		...
> 	}
> 	...
> }

Given the above, I don't see why/how this patch is necessary? @Tony,
@Andrii: could you please give a better/longer description of the issue
addressed here?

Thanks!

Paolo