From: Kees Cook <keescook@chromium.org>
To: glider@google.com
Cc: miklos@szeredi.hu, linux-unionfs@vger.kernel.org,
linux-kernel@vger.kernel.org, royyang@google.com,
stable@vger.kernel.org
Subject: Re: [PATCH] ovl: explicitly initialize error in ovl_copy_xattr()
Date: Wed, 3 Jun 2020 13:35:09 -0700 [thread overview]
Message-ID: <202006031219.36197D0729@keescook> (raw)
In-Reply-To: <20200603174714.192027-1-glider@google.com>
On Wed, Jun 03, 2020 at 07:47:14PM +0200, glider@google.com wrote:
> Under certain circumstances (we found this out running Docker on a
> Clang-built kernel with CONFIG_INIT_STACK_ALL) ovl_copy_xattr() may
> return uninitialized value of |error| from ovl_copy_xattr().
> It is then returned by ovl_create() to lookup_open(), which casts it to
> an invalid dentry pointer, that can be further read or written by the
> lookup_open() callers.
>
> Signed-off-by: Alexander Potapenko <glider@google.com>
Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1050405
Fixes: e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
Cc: stable@vger.kernel.org
Reviewed-by: Kees Cook <keescook@chromium.org>
It seems the error isn't reported anywhere, so the value likely isn't
too important. -EINVAL seems sane to me.
Thought: should CONFIG_INIT_STACK_ALL=y disable uninitialized_var()?
$ git grep uninitialized_var | wc -l
300
We have evidence this is being used inappropriately and is masking bugs.
I would actually think it should should be removed globally, but it
seems especially important for CONFIG_INIT_STACK_ALL=y.
I've opened:
https://github.com/KSPP/linux/issues/81
--
Kees Cook
next prev parent reply other threads:[~2020-06-03 20:35 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-03 17:47 [PATCH] ovl: explicitly initialize error in ovl_copy_xattr() glider
2020-06-03 20:35 ` Kees Cook [this message]
2020-06-03 21:46 ` Vivek Goyal
2020-06-04 8:28 ` Alexander Potapenko
2020-06-04 8:42 glider
2020-06-04 8:57 ` Miklos Szeredi
2020-06-04 16:00 ` Kees Cook
2020-06-04 15:57 ` Kees Cook
2020-06-05 9:46 ` Alexander Potapenko
2020-06-05 9:54 ` Miklos Szeredi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202006031219.36197D0729@keescook \
--to=keescook@chromium.org \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=royyang@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.