linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Willy Tarreau <w@1wt.eu>
To: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Dan Carpenter <dan.carpenter@oracle.com>,
	Will Deacon <will.deacon@arm.com>, Greg KH <greg@kroah.com>
Subject: Re: [PATCH 1/8] lkdtm: change snprintf to scnprintf for possible overflow
Date: Tue, 15 Jan 2019 04:12:35 +0100	[thread overview]
Message-ID: <20190115031235.GA6416@1wt.eu> (raw)
In-Reply-To: <CAGXu5jLGkPqA+ZY7aFizpsRj9VvOhUSfixWcLLVHXwsAo3PQyA@mail.gmail.com>

Hi Kees,

On Mon, Jan 14, 2019 at 05:02:51PM -0800, Kees Cook wrote:
> On Sat, Jan 12, 2019 at 7:28 AM Willy Tarreau <w@1wt.eu> wrote:
> >
> > From: Silvio Cesare <silvio.cesare@gmail.com>
> >
> > Change snprintf to scnprintf. There are generally two cases where using
> > snprintf causes problems.
> 
> (I didn't find a 0/8 cover letter, so I'm replying here...)

I didn't add one simply because I didn't have more context info than
the one already present in each of these commits (which were all the
same by the way). These ones were first reported by Silvio on the
security list on November 23rd and came to a stall by lack of proper
Cc and subject lines. So I've ran get_maintainers.pl + git log to
adjust all this and sent them with the available context.

> Many of these fixes are just robustness updates (e.g. the lkdtm case
> below is not current a problem: the size of the static array getting
> displayed is less than PAGE_SIZE). It might be worth noting which are
> actually problems (and include the appropriate Cc: and Fixes: lines).

From what I remember from the thread, these are small bugs causing some
memory disclosure when used with debugfs. I've just found the featured
article :

   http://blog.infosectcbr.com.au/2018/11/memory-bugs-in-multiple-linux-kernel.html

> Are these changes going into someone's single tree, or are they
> intended for individual maintainers to pick up?

The goal was to let the maintainers decide based on the commit message.

That's why it's always better when the reporter sends the information
by himself rather than relying on some third party to polish things up
and forward :-/

Cheers,
Willy

  parent reply	other threads:[~2019-01-15  3:12 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-12 15:28 [PATCH 1/8] lkdtm: change snprintf to scnprintf for possible overflow Willy Tarreau
2019-01-12 15:28 ` [PATCH 2/8] libertas: " Willy Tarreau
2019-01-15  1:09   ` Kees Cook
2019-01-15  5:55   ` Kalle Valo
2019-01-15 20:35     ` Willy Tarreau
2019-01-16 16:40       ` Kalle Valo
2019-01-16 17:02         ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 3/8] ocfs2: " Willy Tarreau
2019-01-15  1:14   ` Kees Cook
2019-01-12 15:28 ` [PATCH 4/8] ASoC: " Willy Tarreau
2019-01-15  1:13   ` Kees Cook
2019-01-15  1:25   ` Nicolin Chen
2019-01-15  3:18     ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 5/8] scsi: lpfc: " Willy Tarreau
2019-01-15  1:15   ` Kees Cook
2019-01-15 22:41     ` James Smart
2019-03-20 17:39       ` Greg KH
2019-03-20 20:27         ` James Smart
2019-03-21  0:41         ` James Smart
2019-01-12 15:28 ` [PATCH 6/8] ASoC: intel: skylake: " Willy Tarreau
2019-01-15  1:12   ` Kees Cook
2019-01-16 18:41   ` Kees Cook
2019-01-16 19:35     ` Pierre-Louis Bossart
2019-01-16 19:51       ` Kees Cook
2019-01-12 15:28 ` [PATCH 7/8] ASoC: dapm: " Willy Tarreau
2019-01-14 14:56   ` Mark Brown
2019-01-15  3:16     ` Willy Tarreau
2019-01-15 15:44       ` Mark Brown
2019-01-15 15:55         ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 8/8] spi: dw: " Willy Tarreau
2019-01-15  1:09   ` Kees Cook
2019-01-15  1:02 ` [PATCH 1/8] lkdtm: " Kees Cook
2019-01-15  1:07   ` Kees Cook
2019-01-15  3:12   ` Willy Tarreau [this message]
2019-01-15 20:47 ` Kees Cook
2019-01-18 13:06   ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190115031235.GA6416@1wt.eu \
    --to=w@1wt.eu \
    --cc=dan.carpenter@oracle.com \
    --cc=greg@kroah.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=silvio.cesare@gmail.com \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).