From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1163728AbdEXMWZ (ORCPT ); Wed, 24 May 2017 08:22:25 -0400 Received: from mail-wr0-f171.google.com ([209.85.128.171]:33834 "EHLO mail-wr0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757749AbdEXMVn (ORCPT ); Wed, 24 May 2017 08:21:43 -0400 From: Mateusz Jurczyk To: "David S. Miller" , Matthew Whitehead , "Eric W. Biederman" , Tetsuo Handa , Andrew Morton Cc: linux-kernel@vger.kernel.org Subject: [PATCH] sysctl: Check name array length in deprecated_sysctl_warning() Date: Wed, 24 May 2017 14:21:39 +0200 Message-Id: <20170524122139.21333-1-mjurczyk@google.com> X-Mailer: git-send-email 2.13.0.219.gdb65acc882-goog Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Prevent use of uninitialized memory (originating from the stack frame of do_sysctl()) by verifying that the name array is filled with sufficient input data before comparing its specific entries with integer constants. Through timing measurement or analyzing the kernel debug logs, a user-mode program could potentially infer the results of comparisons against the uninitialized memory, and acquire some (very limited) information about the state of the kernel stack. The change also eliminates possible future warnings by tools such as KMSAN and other code checkers / instrumentations. Signed-off-by: Mateusz Jurczyk --- kernel/sysctl_binary.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c index ece4b177052b..38d6ba22a209 100644 --- a/kernel/sysctl_binary.c +++ b/kernel/sysctl_binary.c @@ -1346,7 +1346,7 @@ static void deprecated_sysctl_warning(const int *name, int nlen) * CTL_KERN/KERN_VERSION is used by older glibc and cannot * ever go away. */ - if (name[0] == CTL_KERN && name[1] == KERN_VERSION) + if (nlen >= 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION) return; if (printk_ratelimit()) { -- 2.13.0.219.gdb65acc882-goog