[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1496439121.13303.1.camel@gmail.com>
Date: Fri, 02 Jun 2017 17:32:01 -0400
From: Daniel Micay <danielmicay@...il.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-mm@...ck.org, Kees Cook <keescook@...omium.org>,
kernel-hardening@...ts.openwall.com, linux-kernel
<linux-kernel@...r.kernel.org>, Mark Rutland <mark.rutland@....com>,
Daniel Axtens <dja@...ens.net>, Moni Shoua <monis@...lanox.com>, Doug
Ledford <dledford@...hat.com>, Sean Hefty <sean.hefty@...el.com>, Hal
Rosenstock <hal.rosenstock@...il.com>, linux-rdma@...r.kernel.org
Subject: Re: [PATCH v4] add the option of fortified string.h functions
On Fri, 2017-06-02 at 14:07 -0700, Andrew Morton wrote:
> On Fri, 26 May 2017 05:54:04 -0400 Daniel Micay <danielmicay@...il.com
> > wrote:
>
> > This adds support for compiling with a rough equivalent to the glibc
> > _FORTIFY_SOURCE=1 feature, providing compile-time and runtime buffer
> > overflow checks for string.h functions when the compiler determines
> > the
> > size of the source or destination buffer at compile-time. Unlike
> > glibc,
> > it covers buffer reads in addition to writes.
>
> Did we find a bug in drivers/infiniband/sw/rxe/rxe_resp.c?
>
> i386 allmodconfig:
>
> In file included from ./include/linux/bitmap.h:8:0,
> from ./include/linux/cpumask.h:11,
> from ./include/linux/mm_types_task.h:13,
> from ./include/linux/mm_types.h:4,
> from ./include/linux/kmemcheck.h:4,
> from ./include/linux/skbuff.h:18,
> from drivers/infiniband/sw/rxe/rxe_resp.c:34:
> In function 'memcpy',
> inlined from 'send_atomic_ack.constprop' at
> drivers/infiniband/sw/rxe/rxe_resp.c:998:2,
> inlined from 'acknowledge' at
> drivers/infiniband/sw/rxe/rxe_resp.c:1026:3,
> inlined from 'rxe_responder' at
> drivers/infiniband/sw/rxe/rxe_resp.c:1286:10:
> ./include/linux/string.h:309:4: error: call to '__read_overflow2'
> declared with attribute error: detected read beyond size of object
> passed as 2nd parameter
> __read_overflow2();
>
>
> If so, can you please interpret this for the infiniband developers?
It copies sizeof(skb->cb) bytes with memcpy which is 48 bytes since cb
is a 48 byte char array in `struct sk_buff`. The source buffer is a
`struct rxe_pkt_info`:
struct rxe_pkt_info {
struct rxe_dev *rxe; /* device that owns packet */
struct rxe_qp *qp; /* qp that owns packet */
struct rxe_send_wqe *wqe; /* send wqe */
u8 *hdr; /* points to bth */
u32 mask; /* useful info about pkt */
u32 psn; /* bth psn of packet */
u16 pkey_index; /* partition of pkt */
u16 paylen; /* length of bth - icrc */
u8 port_num; /* port pkt received on */
u8 opcode; /* bth opcode of packet */
u8 offset; /* bth offset from pkt->hdr */
};
That looks like 32 bytes (1 byte of padding) on 32-bit and 48 bytes on
64-bit (1 byte of padding), so on 32-bit there's a read overflow of 16
bytes from the stack here.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
