From: pageexec@freemail.hu
To: Kees Cook <keescook@chromium.org>, Greg KH <gregkh@linuxfoundation.org>
Cc: Ubuntu security discussion <ubuntu-hardened@lists.ubuntu.com>,
linux-kernel@vger.kernel.org,
kernel-hardening@lists.openwall.com, spender@grsecurity.net
Subject: Re: Add overflow protection to kref
Date: Fri, 17 Feb 2012 15:23:23 +0200 [thread overview]
Message-ID: <4F3E62DB.6956.CF97716@pageexec.freemail.hu> (raw)
In-Reply-To: <20120217014008.GA18763@kroah.com>
On 16 Feb 2012 at 17:40, Greg KH wrote:
> > A quick search gives me:
> > CVE-2005-3359: https://bugzilla.redhat.com/show_bug.cgi?id=175769
> > CVE-2006-3741: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b8444d00762703e1b6146fce12ce2684885f8bf6
>
> Neither of those are kref issues, just bugs with other types of
> counting things.
kref is just one of the many users of the atomic type that use it for refcounting.
and kref users are no more immune to programming mistakes that can result in overflow
than direct atomic users.
> Again, I don't know of any kref overflows that have ever happened, so
> trying to "protect" this type of thing, seems odd to me.
well, do you analyze all bugreports/patches/etc for this problem? even if you did
it's easy to miss them because kref_put has so many wrappers around it whose uses
would also have to be checked for. anyway, a very lightweight grep in the git log
turned up these (i spent half a minute on it only, don't expect a flood ;):
14660ccd599dc7bd6ecef17408bd76dc853f9b77
ece84241b93c4693bfe0a8ec9a043a16d216d0cd
b65d457913d1c0644394287d5d834373f42fb99a
94735ec4044a6d318b83ad3c5794e931ed168d10
next prev parent reply other threads:[~2012-02-17 15:19 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAEXv5_gkTsPHDFh+wQqD3P3D-Z+uCN-_1bVyHfHV=u7bS-tgeA@mail.gmail.com>
2012-02-16 20:45 ` Add overflow protection to kref Kees Cook
2012-02-17 0:24 ` Greg Kroah-Hartman
2012-02-17 1:06 ` Kees Cook
2012-02-17 1:40 ` Greg KH
2012-02-17 2:11 ` [ubuntu-hardened] " Kees Cook
2012-02-17 2:48 ` David Windsor
2012-02-17 3:32 ` Greg KH
2012-02-17 6:33 ` Alexey Dobriyan
2012-02-17 13:23 ` pageexec [this message]
2012-02-17 7:59 ` [kernel-hardening] " Vasiliy Kulikov
2012-02-17 17:53 ` Greg KH
2012-02-17 17:54 ` Greg KH
2012-02-17 19:37 ` Vasiliy Kulikov
2012-02-17 23:39 ` Djalal Harouni
2012-02-18 1:44 ` Roland Dreier
2012-02-18 16:15 ` David Windsor
2012-02-18 16:35 ` Vasiliy Kulikov
2012-02-18 16:18 ` Greg KH
2012-02-24 17:58 ` David Windsor
2012-02-24 18:37 ` Greg KH
2012-02-24 18:52 ` Kees Cook
2012-02-24 19:05 ` Nick Bowler
2012-02-24 19:13 ` Vasiliy Kulikov
2012-02-24 19:35 ` Nick Bowler
2012-02-24 21:59 ` PaX Team
2012-02-24 18:58 ` Vasiliy Kulikov
2012-02-24 19:41 ` Greg KH
2012-02-24 20:04 ` Kees Cook
2012-02-24 19:04 ` David Windsor
2012-02-24 22:14 ` PaX Team
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F3E62DB.6956.CF97716@pageexec.freemail.hu \
--to=pageexec@freemail.hu \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=spender@grsecurity.net \
--cc=ubuntu-hardened@lists.ubuntu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox