Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751359AbdGQJhl (ORCPT ); Mon, 17 Jul 2017 05:37:41 -0400 Received: from mail-ua0-f179.google.com ([209.85.217.179]:33104 "EHLO mail-ua0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751298AbdGQJhj (ORCPT ); Mon, 17 Jul 2017 05:37:39 -0400 MIME-Version: 1.0 In-Reply-To: <20170714.105431.403659291323482633.davem@davemloft.net> References: <20170714.102312.821784668156442305.davem@davemloft.net> <20170714.105431.403659291323482633.davem@davemloft.net> From: Alexander Potapenko Date: Mon, 17 Jul 2017 11:37:37 +0200 Message-ID: Subject: Re: [PATCH v2] sctp: don't dereference ptr before leaving _sctp_walk_{params,errors}() To: David Miller Cc: Dmitriy Vyukov , Kostya Serebryany , Eric Dumazet , lucien xin , LKML , Networking Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v6H9bkxd027074 Content-Length: 2383 Lines: 57 On Fri, Jul 14, 2017 at 7:54 PM, David Miller wrote: > From: Alexander Potapenko > Date: Fri, 14 Jul 2017 19:33:54 +0200 > >> On Fri, Jul 14, 2017 at 7:23 PM, David Miller wrote: >>> From: Alexander Potapenko >>> Date: Fri, 14 Jul 2017 18:33:01 +0200 >>> >>>> On Fri, Jul 14, 2017 at 5:58 PM, David Miller wrote: >>>>> From: Alexander Potapenko >>>>> Date: Fri, 14 Jul 2017 12:03:29 +0200 >>>>> >>>>>> v2: per comment from David Miller, make sure the whole iterator->length >>>>>> fits into the remaining buffer. >>>>> >>>>> Please compile and functionally test your changes: >>>>> >>>>> In file included from ./include/linux/compiler.h:58:0, >>>>> from ./include/uapi/linux/stddef.h:1, >>>>> from ./include/linux/stddef.h:4, >>>>> from ./include/uapi/linux/posix_types.h:4, >>>>> from ./include/uapi/linux/types.h:13, >>>>> from ./include/linux/types.h:5, >>>>> from net/sctp/sm_statefuns.c:48: >>>>> net/sctp/sm_statefuns.c: In function ‘sctp_sf_do_reconf’: >>>>> ./include/net/sctp/sctp.h:472:24: error: unknown type name ‘sctp_paramhdr_t’ >>>>> (pos.v + offsetof(sctp_paramhdr_t, length) + sizeof(pos.p->length) <\ >>>>> ^ >>>> Oops. Fixed. >>> >>> Did you functionally test the new version or just do a quick compile >>> check and resubmit? >> I've checked that the kernel still works, but unfortunately I couldn't >> check whether or not this affected the uninit memory, as KMSAN >> currently works on a fixed kernel revision. The compilation error was >> actually caused by me failing to test the kernel when porting the fix >> from that revision to upstream. >> >>> I really want you to test this if the logic has been changed. >> Do you mean any specific tests in addition to, say, running the >> reproducer on which the uninit use was reported? > > I mean the reproducer. Yes, I've ran the reproducer, and just double-checked that. Sorry for the delay. -- Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Straße, 33 80636 München Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg