From: Kees Cook <kees.cook@canonical.com>
To: "Robert Święcki" <robert@swiecki.net>
Cc: linux-kernel@vger.kernel.org, taviso@cmpxchg8b.com, security@kernel.org
Subject: Re: Kernel panic (NULL ptr deref?) in find_ge_pid()/next_pidmap() (via sys_getdents or sys_readdir)
Date: Mon, 18 Apr 2011 12:37:15 -0700 [thread overview]
Message-ID: <20110418193715.GH4800@outflux.net> (raw)
In-Reply-To: <BANLkTi=5k1r-hxNerVKAsXeKksvLSaSU8A@mail.gmail.com>
Hi Robert,
On Mon, Apr 18, 2011 at 02:57:55PM +0200, Robert Święcki wrote:
> and a repro - should be quite obvious for FS folks, I guess
> filp->f_pos needs better checking in proc's readdir (or in llseek).
Yup:
int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
{
unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
...
for (; nr < ARRAY_SIZE(proc_base_stuff); filp->f_pos++, nr++) {
...
}
ns = filp->f_dentry->d_sb->s_fs_info;
iter.task = NULL;
iter.tgid = filp->f_pos - TGID_OFFSET;
...
There's no test to validate f_pos. If it's out of bounds, the "for"
just doesn't run.
-Kees
--
Kees Cook
Ubuntu Security Team
prev parent reply other threads:[~2011-04-18 19:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <BANLkTik8nOXJb3J9=m4-2Ugw4P7AFzCQoA@mail.gmail.com>
2011-04-13 21:36 ` Robert Święcki
2011-04-14 16:39 ` Robert Święcki
2011-04-18 6:53 ` Robert Święcki
2011-04-18 12:57 ` Robert Święcki
2011-04-18 19:37 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110418193715.GH4800@outflux.net \
--to=kees.cook@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=robert@swiecki.net \
--cc=security@kernel.org \
--cc=taviso@cmpxchg8b.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®