lkml.org 
[lkml]   [2009]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] ipvs: Add boundary check on ioctl arguments
    On Wed, 30 Sep 2009 22:41:05 +0300 (EEST)
    Julian Anastasov <ja@ssi.bg> wrote:

    >
    > Hello,
    >
    > On Wed, 30 Sep 2009, Arjan van de Ven wrote:
    >
    > > fair enough; updated patch below



    > Later len can be checked
    > additionally and surely can exceed 128 (include/linux/ip_vs.h has
    > all user structures).

    the on-stack structure currently is 128 bytes though...

    > Can you show the exact cmd and len
    > used, may be there is error in some command or may be the
    > provided user structure is wrong?

    this comes from code inspection using gcc features; this
    is one of the (few) cases in the kernel where gcc cannot prove
    that the copy_from_user() length for the copy-to-stack is sufficiently
    bounds checked. I'm trying to make sure all these cases have
    complete enough checks, both for the obvious security reasons but
    also to be able to then make gcc emit a warning to prevent future
    issues from popping up.



    --
    Arjan van de Ven Intel Open Source Technology Centre
    For development, discussion and tips for power savings,
    visit http://www.lesswatts.org


    \
     
     \ /
      Last update: 2009-10-01 23:55    [W:0.024 / U:61.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site