diff for duplicates of <202608140244.f2Omwf4y-lkp@intel.com> diff --git a/a/1.txt b/N1/1.txt index 9d6efb0..b223caf 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,15 +1,6 @@ -BCC: lkp@intel.com -CC: oe-kbuild-all@lists.linux.dev -CC: linux-kernel@vger.kernel.org -TO: Michael Bommarito <michael.bommarito@gmail.com> -CC: Jakub Kicinski <kuba@kernel.org> - tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 3d6d817622b0a9721e3cc404df3469171582be13 commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks -date: 4 months ago -:::::: branch date: 27 hours ago -:::::: commit date: 4 months ago config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config) compiler: m68k-linux-gcc (GCC) 10.5.0 smatch: v0.5.0-9187-g5189e3fb @@ -32,7 +23,6 @@ net/sctp/socket.c:9018 sctp_wait_for_packet() warn: missing error code 'error' vim +7036 net/sctp/socket.c -65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7005 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7006 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7007 char __user *optval, int __user *optlen) 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7008 { @@ -64,9 +54,19 @@ c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08 7019 if (copy_from_user(&va 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7034 /* See if the user provided enough room for all the data */ 3c918704921412 Xin Long 2017-06-30 7035 num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr); 0cf004ffb61cd3 Michael Bommarito 2026-04-15 @7036 if (len < sizeof(struct sctp_authchunks) + num_chunks) + +This is a m68k-linux-gcc build (32 bits). sizeof(struct sctp_paramhdr) +is 4 and sizeof(struct sctp_authchunks) is 8 so on a 32bit system if +num_chunks U32_MAX - 4 then the "sizeof(struct sctp_authchunks) + +num_chunks" math could overflow. + 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7037 return -EINVAL; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7038 5e739d1752aca4 Vlad Yasevich 2008-08-21 7039 if (copy_to_user(to, ch->chunks, num_chunks)) + +It doesn't really cause a problem these days because copy_to_user() +doesn't accept sizes more than INT_MAX but it would trigger a warning. + 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7040 return -EFAULT; 5e739d1752aca4 Vlad Yasevich 2008-08-21 7041 num: 5e739d1752aca4 Vlad Yasevich 2008-08-21 7042 len = sizeof(struct sctp_authchunks) + num_chunks; @@ -76,7 +76,6 @@ c76f97c99ae6d2 Marcelo Ricardo Leitner 2018-01-08 7019 if (copy_from_user(&va 7e8616d8e7731b Vlad Yasevich 2008-02-27 7046 return -EFAULT; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7047 return 0; 65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7048 } -65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7049 -- 0-DAY CI Kernel Test Service diff --git a/a/content_digest b/N1/content_digest index 9e1cb72..6ac2492 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,23 +1,17 @@ - "From\0kernel test robot <lkp@intel.com>\0" + "From\0Dan Carpenter <error27@gmail.com>\0" "Subject\0net/sctp/socket.c:7036 sctp_getsockopt_peer_auth_chunks() warn: potential user controlled sizeof overflow '8 + num_chunks' '8 + 0-65531,4294967292-u32max'\0" - "Date\0Fri, 14 Aug 2026 02:08:20 +0800\0" - "To\0oe-kbuild@lists.linux.dev\0" + "Date\0Thu, 13 Aug 2026 22:05:49 +0300\0" + "To\0oe-kbuild@lists.linux.dev" + " Michael Bommarito <michael.bommarito@gmail.com>\0" "Cc\0lkp@intel.com" - " Dan Carpenter <error27@gmail.com>\0" + oe-kbuild-all@lists.linux.dev + linux-kernel@vger.kernel.org + " Jakub Kicinski <kuba@kernel.org>\0" "\00:1\0" "b\0" - "BCC: lkp@intel.com\n" - "CC: oe-kbuild-all@lists.linux.dev\n" - "CC: linux-kernel@vger.kernel.org\n" - "TO: Michael Bommarito <michael.bommarito@gmail.com>\n" - "CC: Jakub Kicinski <kuba@kernel.org>\n" - "\n" "tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master\n" "head: 3d6d817622b0a9721e3cc404df3469171582be13\n" "commit: 0cf004ffb61cd32d140531c3a84afe975f9fc7ea sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n" - "date: 4 months ago\n" - ":::::: branch date: 27 hours ago\n" - ":::::: commit date: 4 months ago\n" "config: m68k-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260814/202608140244.f2Omwf4y-lkp@intel.com/config)\n" "compiler: m68k-linux-gcc (GCC) 10.5.0\n" "smatch: v0.5.0-9187-g5189e3fb\n" @@ -40,7 +34,6 @@ "\n" "vim +7036 net/sctp/socket.c\n" "\n" - "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7005 \n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7006 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7007 \t\t\t\t char __user *optval, int __user *optlen)\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7008 {\n" @@ -72,9 +65,19 @@ "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7034 \t/* See if the user provided enough room for all the data */\n" "3c918704921412 Xin Long 2017-06-30 7035 \tnum_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);\n" "0cf004ffb61cd3 Michael Bommarito 2026-04-15 @7036 \tif (len < sizeof(struct sctp_authchunks) + num_chunks)\n" + "\n" + "This is a m68k-linux-gcc build (32 bits). sizeof(struct sctp_paramhdr)\n" + "is 4 and sizeof(struct sctp_authchunks) is 8 so on a 32bit system if\n" + "num_chunks U32_MAX - 4 then the \"sizeof(struct sctp_authchunks) +\n" + "num_chunks\" math could overflow.\n" + "\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7037 \t\treturn -EINVAL;\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7038 \n" "5e739d1752aca4 Vlad Yasevich 2008-08-21 7039 \tif (copy_to_user(to, ch->chunks, num_chunks))\n" + "\n" + "It doesn't really cause a problem these days because copy_to_user()\n" + "doesn't accept sizes more than INT_MAX but it would trigger a warning.\n" + "\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7040 \t\treturn -EFAULT;\n" "5e739d1752aca4 Vlad Yasevich 2008-08-21 7041 num:\n" "5e739d1752aca4 Vlad Yasevich 2008-08-21 7042 \tlen = sizeof(struct sctp_authchunks) + num_chunks;\n" @@ -84,10 +87,9 @@ "7e8616d8e7731b Vlad Yasevich 2008-02-27 7046 \t\treturn -EFAULT;\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7047 \treturn 0;\n" "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7048 }\n" - "65b07e5d0d09c7 Vlad Yasevich 2007-09-16 7049 \n" "\n" "--\n" "0-DAY CI Kernel Test Service\n" https://github.com/intel/lkp-tests/wiki -3c5de7d3218728ef56d4b3d4346e8f5a1f36fa49c39fd6160efa4ec49fa9d07f +19a170343821c431067f16278516235761f26c3f76fb7baf0275afc4aac4a4ef
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.