From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F9CBC4363A for ; Mon, 26 Oct 2020 23:40:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 23C9420872 for ; Mon, 26 Oct 2020 23:40:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603755617; bh=ZgbflWpbtTfBxG7usPJTb2WZqEYqd438hFIgnDyXuZk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=uWuLr7nivEfl66LNOllRBSc5ZGsBh9bjTqW/GJNfg2B2GhmbCIr02vSN+7y0xhS6L ZFUbYoVmu65DNLiYpPUsXMg2BA2OKlCnv2QbqOocIx5DClxyvM0bwiQMGfwrw/7EJX 0a5/E+Z2o/qzsLWTootw8rS0/Ck3w9NIjkUuT3Qs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2407440AbgJZXkN (ORCPT ); Mon, 26 Oct 2020 19:40:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:37002 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2407433AbgJZXkM (ORCPT ); Mon, 26 Oct 2020 19:40:12 -0400 Received: from gmail.com (unknown [104.132.1.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8C14C206FB; Mon, 26 Oct 2020 23:40:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603755611; bh=ZgbflWpbtTfBxG7usPJTb2WZqEYqd438hFIgnDyXuZk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=s4jrG+TkxPz3M1yPMrS2r30WcawYO1jYf1AyyGHiEtn1vMdQ1ui0K8jDexcGCGsR4 qgptXFeRExv0dD6gh+fJm5OBVo/+BvYnP2/KSs6/f7rLeJY31E+VlYDOdJudJL6N96 sKfCkkyZpbO6hx2jpem2/n1ODJmzZYKLLznl6ih8= Date: Mon, 26 Oct 2020 16:40:10 -0700 From: Eric Biggers To: "Gustavo A. R. Silva" Cc: linux-crypto@vger.kernel.org, Herbert Xu , syzkaller-bugs@googlegroups.com, linux-hardening@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Jann Horn , Kees Cook , Elena Petrova , Vegard Nossum , stable@vger.kernel.org, syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com Subject: Re: [PATCH] crypto: af_alg - avoid undefined behavior accessing salg_name Message-ID: <20201026234010.GD1947033@gmail.com> References: <20201026200715.170261-1-ebiggers@kernel.org> <20201026212148.GA26823@embeddedor> <20201026231059.GB26823@embeddedor> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20201026231059.GB26823@embeddedor> Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On Mon, Oct 26, 2020 at 06:10:59PM -0500, Gustavo A. R. Silva wrote: > On Mon, Oct 26, 2020 at 04:21:48PM -0500, Gustavo A. R. Silva wrote: > > > +/* > > > + * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an > > > + * arbitrary-length field. We had to keep the original struct above for source > > > + * compatibility with existing userspace programs, though. Use the new struct > > > + * below if support for very long algorithm names is needed. To do this, > > > + * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and > > > + * copy algname (including the null terminator) into salg_name. > > > + */ > > > +struct sockaddr_alg_new { > > > + __u16 salg_family; > > > + __u8 salg_type[14]; > > > + __u32 salg_feat; > > > + __u32 salg_mask; > > > + __u8 salg_name[]; > > > +}; > > > + > > > > How something like this, instead: > > > > struct sockaddr_alg { > > - __u16 salg_family; > > - __u8 salg_type[14]; > > - __u32 salg_feat; > > - __u32 salg_mask; > > - __u8 salg_name[64]; > > + union { > > + struct { > > + __u16 salg_v1_family; > > + __u8 salg_v1_type[14]; > > + __u32 salg_v1_feat; > > + __u32 salg_v1_mask; > > + __u8 salg_name[64]; > > + }; > > + struct { > > + __u16 salg_family; > > + __u8 salg_type[14]; > > + __u32 salg_feat; > > + __u32 salg_mask; > > + __u8 salg_name_new[]; > > + }; > > + }; > > }; > > > > Something similar to the following approach might work: > > https://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux.git/commit/?h=testing/uapi/gntalloc&id=db46c8aba41c436edb0b4ef2941bd7390b0e5d61 > I suppose so. It's very confusing to see a union like that at first glance, though. It definitely needs an explanatory comment... - Eric