From patchwork Mon Jan 10 14:06:58 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 78158 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 17D2AB70AF for ; Tue, 11 Jan 2011 01:07:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754010Ab1AJOHY (ORCPT ); Mon, 10 Jan 2011 09:07:24 -0500 Received: from mail-gw0-f46.google.com ([74.125.83.46]:41255 "EHLO mail-gw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753800Ab1AJOHW (ORCPT ); Mon, 10 Jan 2011 09:07:22 -0500 Received: by gwj20 with SMTP id 20so8520695gwj.19 for ; Mon, 10 Jan 2011 06:07:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=OP0cXImTBH3ctp8ykTh7HhPeXTy8ZBmbg5jo/aPhrCw=; b=ji3Xpxfuy1HhngupCuOGix6ptcGruMOIxL3la3VlGdHjyIjXXyY4HXoViLHpc01iau Xuv7pj4Ue8R2P8FUbsOKeffBThbU3d5WrDlX2Mn+vEPOmBXkN17Of+ObsShv2m/bEYwJ LcRUDiv66mWxypmV8SDHCUEB5R2u/LOyOlqaA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=wFEdxfR71owJQqJ58T6Auifxv46n1EouynwdtRtiDBjHOpJPKomiNPO76uRdaGxjn7 dQcqCRzpEds3b4IEFlSiXOcXmq2cXUXPFT6je7YJcENBiSTVDqhOt57dp9KZOVxWG5Up GL65ni7FXG7VCcfzYJiSfVcdRLz3Dlw4zBo0U= Received: by 10.150.212.8 with SMTP id k8mr5716607ybg.311.1294668441648; Mon, 10 Jan 2011 06:07:21 -0800 (PST) Received: from bicker (h14ba.n2.ips.mtn.co.ug [212.88.116.186]) by mx.google.com with ESMTPS id v8sm14706249yba.14.2011.01.10.06.07.08 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 10 Jan 2011 06:07:20 -0800 (PST) Date: Mon, 10 Jan 2011 17:06:58 +0300 From: Dan Carpenter To: =?iso-8859-1?Q?R=E9mi?= Denis-Courmont Cc: "David S. Miller" , netdev@vger.kernel.org, kernel-janitors@vger.kernel.org, dan.j.rosenberg@gmail.com Subject: [patch v2] phonet: some signedness bugs Message-ID: <20110110140658.GB2721@bicker> References: <20110107203755.GB1959@bicker> <201101100958.32549.remi.denis-courmont@nokia.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <201101100958.32549.remi.denis-courmont@nokia.com> User-Agent: Mutt/1.5.20 (2009-06-14) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Dan Rosenberg pointed out that there were some signed comparison bugs in the phonet protocol. http://marc.info/?l=full-disclosure&m=129424528425330&w=2 The problem is that we check for array overflows but "protocol" is signed and we don't check for array underflows. If you have already have CAP_SYS_ADMIN then you could use the bugs to get root, or someone could cause an oops by mistake. Signed-off-by: Dan Carpenter Acked-by: Rémi Denis-Courmont --- v2: in v1 I changed pn_socket_create() but that change caused a compiler warning. That part of the patch wasn't needed so I've just dropped. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h index d5df797..5395e09 100644 --- a/include/net/phonet/phonet.h +++ b/include/net/phonet/phonet.h @@ -107,8 +107,8 @@ struct phonet_protocol { int sock_type; }; -int phonet_proto_register(int protocol, struct phonet_protocol *pp); -void phonet_proto_unregister(int protocol, struct phonet_protocol *pp); +int phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp); +void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp); int phonet_sysctl_init(void); void phonet_sysctl_exit(void); diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index fd95beb..1072b2c 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -37,7 +37,7 @@ /* Transport protocol registration */ static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly; -static struct phonet_protocol *phonet_proto_get(int protocol) +static struct phonet_protocol *phonet_proto_get(unsigned int protocol) { struct phonet_protocol *pp; @@ -458,7 +458,7 @@ static struct packet_type phonet_packet_type __read_mostly = { static DEFINE_MUTEX(proto_tab_lock); -int __init_or_module phonet_proto_register(int protocol, +int __init_or_module phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp) { int err = 0; @@ -481,7 +481,7 @@ int __init_or_module phonet_proto_register(int protocol, } EXPORT_SYMBOL(phonet_proto_register); -void phonet_proto_unregister(int protocol, struct phonet_protocol *pp) +void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp) { mutex_lock(&proto_tab_lock); BUG_ON(proto_tab[protocol] != pp);