Re: [PATCH v2] sctp: don't dereference ptr before leaving _sctp_walk_{params,errors}()

[Alexander Potapenko]

On Fri, Jul 14, 2017 at 7:23 PM, David Miller <davem@xxxxxxxxxxxxx> wrote:
> From: Alexander Potapenko <glider@xxxxxxxxxx>
> Date: Fri, 14 Jul 2017 18:33:01 +0200
>
>> On Fri, Jul 14, 2017 at 5:58 PM, David Miller <davem@xxxxxxxxxxxxx> wrote:
>>> From: Alexander Potapenko <glider@xxxxxxxxxx>
>>> Date: Fri, 14 Jul 2017 12:03:29 +0200
>>>
>>>>  v2: per comment from David Miller, make sure the whole iterator->length
>>>>      fits into the remaining buffer.
>>>
>>> Please compile and functionally test your changes:
>>>
>>> In file included from ./include/linux/compiler.h:58:0,
>>>                  from ./include/uapi/linux/stddef.h:1,
>>>                  from ./include/linux/stddef.h:4,
>>>                  from ./include/uapi/linux/posix_types.h:4,
>>>                  from ./include/uapi/linux/types.h:13,
>>>                  from ./include/linux/types.h:5,
>>>                  from net/sctp/sm_statefuns.c:48:
>>> net/sctp/sm_statefuns.c: In function âsctp_sf_do_reconfâ:
>>> ./include/net/sctp/sctp.h:472:24: error: unknown type name âsctp_paramhdr_tâ
>>>       (pos.v + offsetof(sctp_paramhdr_t, length) + sizeof(pos.p->length) <\
>>>                         ^
>> Oops. Fixed.
>
> Did you functionally test the new version or just do a quick compile
> check and resubmit?
I've checked that the kernel still works, but unfortunately I couldn't
check whether or not this affected the uninit memory, as KMSAN
currently works on a fixed kernel revision. The compilation error was
actually caused by me failing to test the kernel when porting the fix
from that revision to upstream.

> I really want you to test this if the logic has been changed.
Do you mean any specific tests in addition to, say, running the
reproducer on which the uninit use was reported?

Thanks


-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-StraÃe, 33
80636 MÃnchen

GeschÃftsfÃhrer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg