From: Willy Tarreau <w@1wt.eu>
To: Kalle Valo <kvalo@codeaurora.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>,
linux-kernel@vger.kernel.org,
Dan Carpenter <dan.carpenter@oracle.com>,
Kees Cook <keescook@chromium.org>,
Will Deacon <will.deacon@arm.com>, Greg KH <greg@kroah.com>
Subject: Re: [PATCH 2/8] libertas: change snprintf to scnprintf for possible overflow
Date: Tue, 15 Jan 2019 21:35:03 +0100 [thread overview]
Message-ID: <20190115203503.GA7117@1wt.eu> (raw)
In-Reply-To: <878szma2hz.fsf@codeaurora.org>
On Tue, Jan 15, 2019 at 07:55:36AM +0200, Kalle Valo wrote:
> Willy Tarreau <w@1wt.eu> writes:
>
> > From: Silvio Cesare <silvio.cesare@gmail.com>
> >
> > Change snprintf to scnprintf. There are generally two cases where using
> > snprintf causes problems.
> >
> > 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
> > In this case, if snprintf would have written more characters than what the
> > buffer size (SIZE) is, then size will end up larger than SIZE. In later
> > uses of snprintf, SIZE - size will result in a negative number, leading
> > to problems. Note that size might already be too large by using
> > size = snprintf before the code reaches a case of size += snprintf.
> >
> > 2) If size is ultimately used as a length parameter for a copy back to user
> > space, then it will potentially allow for a buffer overflow and information
> > disclosure when size is greater than SIZE. When the size is used to index
> > the buffer directly, we can have memory corruption. This also means when
> > size = snprintf... is used, it may also cause problems since size may become
> > large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
> > configuration.
> >
> > The solution to these issues is to use scnprintf which returns the number of
> > characters actually written to the buffer, so the size variable will never
> > exceed SIZE.
> >
> > Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com>
> > Cc: Kalle Valo <kvalo@codeaurora.org>
> > Cc: Dan Carpenter <dan.carpenter@oracle.com>
> > Cc: Kees Cook <keescook@chromium.org>
> > Cc: Will Deacon <will.deacon@arm.com>
> > Cc: Greg KH <greg@kroah.com>
> > Signed-off-by: Willy Tarreau <w@1wt.eu>
>
> I don't see any mention about which tree this should go to. Can I take
> this to wireless-drivers-next?
Possibly. It addresses a small memory disclosure issue when using debugfs,
and as such it should probably also be submitted to stable branches, so
please use the most suitable tree that doesn't add too much extra delay.
Thanks,
Willy
next prev parent reply other threads:[~2019-01-15 20:35 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-12 15:28 [PATCH 1/8] lkdtm: change snprintf to scnprintf for possible overflow Willy Tarreau
2019-01-12 15:28 ` [PATCH 2/8] libertas: " Willy Tarreau
2019-01-15 1:09 ` Kees Cook
2019-01-15 5:55 ` Kalle Valo
2019-01-15 20:35 ` Willy Tarreau [this message]
2019-01-16 16:40 ` Kalle Valo
2019-01-16 17:02 ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 3/8] ocfs2: " Willy Tarreau
2019-01-15 1:14 ` Kees Cook
2019-01-12 15:28 ` [PATCH 4/8] ASoC: " Willy Tarreau
2019-01-15 1:13 ` Kees Cook
2019-01-15 1:25 ` Nicolin Chen
2019-01-15 3:18 ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 5/8] scsi: lpfc: " Willy Tarreau
2019-01-15 1:15 ` Kees Cook
2019-01-15 22:41 ` James Smart
2019-03-20 17:39 ` Greg KH
2019-03-20 20:27 ` James Smart
2019-03-21 0:41 ` James Smart
2019-01-12 15:28 ` [PATCH 6/8] ASoC: intel: skylake: " Willy Tarreau
2019-01-15 1:12 ` Kees Cook
2019-01-16 18:41 ` Kees Cook
2019-01-16 19:35 ` Pierre-Louis Bossart
2019-01-16 19:51 ` Kees Cook
2019-01-12 15:28 ` [PATCH 7/8] ASoC: dapm: " Willy Tarreau
2019-01-14 14:56 ` Mark Brown
2019-01-15 3:16 ` Willy Tarreau
2019-01-15 15:44 ` Mark Brown
2019-01-15 15:55 ` Willy Tarreau
2019-01-12 15:28 ` [PATCH 8/8] spi: dw: " Willy Tarreau
2019-01-15 1:09 ` Kees Cook
2019-01-15 1:02 ` [PATCH 1/8] lkdtm: " Kees Cook
2019-01-15 1:07 ` Kees Cook
2019-01-15 3:12 ` Willy Tarreau
2019-01-15 20:47 ` Kees Cook
2019-01-18 13:06 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190115203503.GA7117@1wt.eu \
--to=w@1wt.eu \
--cc=dan.carpenter@oracle.com \
--cc=greg@kroah.com \
--cc=keescook@chromium.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=silvio.cesare@gmail.com \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).