From mboxrd@z Thu Jan 1 00:00:00 1970 From: Wenwen Wang Subject: Re: [PATCH] net: socket: fix a missing-check bug Date: Mon, 29 Oct 2018 13:53:39 -0500 Message-ID: References: <1540051091-16604-1-git-send-email-wang6495@umn.edu> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Kangjie Lu , "David S. Miller" , "open list:NETWORKING [GENERAL]" , open list , Wenwen Wang To: f.fainelli@gmail.com Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Hi Florian, Thanks for your response. The bug is found with the assistance of a research prototype, which is now not available to the public. Yes, this is a kind of time-of-check-to-time-of-use (TOCTTOU) bug. BTW, could you please confirm this bug? Thanks! Wenwen On Sat, Oct 20, 2018 at 10:21 PM Florian Fainelli wrote: > > Hi Wenwen, > > On October 20, 2018 8:58:10 AM PDT, Wenwen Wang wrote: > >In ethtool_ioctl(), the ioctl command is firstly obtained from the > >user-space buffer 'compat_rxnfc' through get_user() and saved to > >'ethcmd'. > >Then, 'ethcmd' is checked to see whether it is necessary to pre-process > >the > >ethool structure, because the structure ethtool_rxnfc is defined with > >padding, as mentioned in the comment. If yes, a user-space buffer > >'rxnfc' > >is allocated through compat_alloc_user_space() and then the data in the > >original buffer 'compat_rxnfc' is copied to 'rxnfc' through > >copy_in_user(), > >including the ioctl command. It is worth noting that after this copy, > >there > >is no check enforced on the copied ioctl command. That means it is > >possible > >that 'rxnfc->cmd' is different from 'ethcmd', because a malicious user > >can > >race to modify the ioctl command in 'compat_rxnfc' between these two > >copies. Eventually, the ioctl command in 'rxnfc' will be used in > >dev_ethtool(). This can cause undefined behavior of the kernel and > >introduce potential security risk. > > > >This patch avoids the above issue by rewriting 'rxnfc->cmd' using > >'ethcmd' > >after copy_in_user(). > > > >Signed-off-by: Wenwen Wang > > Assuming these issues are found with some kind of automated analysis, can you also add in your work flow to provide a Fixes: tag such that this could be backported to stable kernels? > > If this is found by a tool is this something that is open source and somehow available? I would also make it clear that these issues are typically named time TOCTOU which might be clearer for people who review those patches. > > Thanks! > -- > Florian