Received: by 10.192.165.156 with SMTP id m28csp1204129imm; Wed, 18 Apr 2018 06:02:15 -0700 (PDT) X-Google-Smtp-Source: AIpwx4/uEqxvBT4EbuJxcipIBtTfuzVedPfy8OY+47ryaxH19l4968BoIUnJfLLYuLieUaA+9bLp X-Received: by 2002:a17:902:9a48:: with SMTP id x8-v6mr2019750plv.135.1524056535459; Wed, 18 Apr 2018 06:02:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524056535; cv=none; d=google.com; s=arc-20160816; b=wePuzl2BhKcidQmVrY3odepAaS0SoHf0mCGgThR+WlBCpdp+C5fmZM5whos7LE+U+0 YImFi9tCmYSTjK3pmbs7rznZgO+TsgYQXnqfGF22FjGDj+ClkAPsVv8SrfqjWPDgRGEy XEHbJsnEd9IWjy8UPe6RDfxO7JKnMRZNODZMzaYOnm6YYq25XEu38h77hyT+ltRPvT90 eRechRZzni6dX9CQOQDJNoe5p2LL4+AB848KkXgiLU7eaEKHups5Cc1/DwG86lk1CSQM ulsA3qqVbMai3xE+Bn371dcCBaZkYW9mhlsiXo5l4WSahNFGGvLwubqoOyFWkXHZ8CqM 7Ngg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:autocrypt:openpgp:from:references:cc:to:subject:reply-to :arc-authentication-results; bh=NyrBhvnU/3qPcqsQkuto9pT8qmPk4zrwc3L1OGL6lkg=; b=tGunKKfdkaCnKgkDIcN3VUyhFXIE+6+Omti72lPrn0AVd0qZzAo+kgrTwBsV+f66Yt eyavNHHgcpjgmegMb0ZSTOS3p+Kb1PVEnd+II36zr+aatGeDhPSTEuAHJTKnHoht6DuR d1jsDYJk+Z/OU3cq98QConm1kaSQbN2EWh/gn7al4Krf8RfGfdLSo4/gEdwJVbgOTuKu ZiI21K0KWjYSagLRHbcUCobK3ENJBthhluFLYa/KjkKVpFXj6eKUqoKCQ/S4PsTIiqMQ Sv004O2rSE+zaE+t5DnV1SzEZGoSk5fY7j9uIW/dpDaeEIerU95PxuFAdI18XmeW0AAm L/5Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q7si1084876pga.86.2018.04.18.06.01.46; Wed, 18 Apr 2018 06:02:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753934AbeDRNA3 (ORCPT + 99 others); Wed, 18 Apr 2018 09:00:29 -0400 Received: from mail-wr0-f195.google.com ([209.85.128.195]:42376 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753807AbeDRNA1 (ORCPT ); Wed, 18 Apr 2018 09:00:27 -0400 Received: by mail-wr0-f195.google.com with SMTP id s18-v6so4586163wrg.9; Wed, 18 Apr 2018 06:00:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:reply-to:subject:to:cc:references:from:openpgp :autocrypt:message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=NyrBhvnU/3qPcqsQkuto9pT8qmPk4zrwc3L1OGL6lkg=; b=HcI4vpm/LCHeTiQ5/1yamGLVGmoOPYQjouW+IBRNuEH9TCBMDw9lVrlBZ/+qPnxLv1 Wg71gevRhKxFxnKdRuzvSAwnseaImy85x/7iA9X9rsCigq+czPJlFdX7EF56ruvF1fZk JZsQJQksaODvh8S2VPR/gy1XpS0RoURMASxGwxjFDvZ6PMwNpKKcCiI9IRhRe+B3+6B8 AJ4qnqNWOnoXRqZ5R8qaogVD/3DwqZ76aopolwfCGqdIIDam+HaaZFI/mYvURuoaGdS3 8y2cmPlSGUqfb6xciNNX8WuJCSsC5EcPM9vXuc8rJIZDztnY0ejCVH5u1kZexK+8mxQX FQNw== X-Gm-Message-State: ALQs6tCFOJUgPy9BdBiFV3cFEMnASU9fOUm8YNGR35G3sYOT7QbZ5NoE y1QvbB9AwFgABULLHFHkxf8= X-Received: by 10.28.94.201 with SMTP id s192mr1789629wmb.42.1524056425690; Wed, 18 Apr 2018 06:00:25 -0700 (PDT) Received: from [10.9.0.26] ([46.166.128.205]) by smtp.gmail.com with ESMTPSA id k30-v6sm3445022wrf.1.2018.04.18.06.00.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 18 Apr 2018 06:00:24 -0700 (PDT) Reply-To: alex.popov@linux.com Subject: Re: [PATCH 1/1] i2c: dev: check i2c_msg len before memdup_user() to prevent ZERO_SIZE_PTR deref To: =?UTF-8?Q?Uwe_Kleine-K=c3=b6nig?= Cc: Wolfram Sang , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, sil2review@lists.osadl.org, Dmitry Vyukov References: <1524010605-21552-1-git-send-email-alex.popov@linux.com> <20180418070704.35zj5chpdkirnmdt@pengutronix.de> <92f44b44-a5a1-c844-4d96-db0697b2e090@linux.com> <20180418082319.wxxhwxwhblwh6llo@pengutronix.de> From: Alexander Popov Openpgp: preference=signencrypt Autocrypt: addr=alex.popov@linux.com; prefer-encrypt=mutual; keydata= xsFNBFX15q4BEADZartsIW3sQ9R+9TOuCFRIW+RDCoBWNHhqDLu+Tzf2mZevVSF0D5AMJW4f UB1QigxOuGIeSngfmgLspdYe2Kl8+P8qyfrnBcS4hLFyLGjaP7UVGtpUl7CUxz2Hct3yhsPz ID/rnCSd0Q+3thrJTq44b2kIKqM1swt/F2Er5Bl0B4o5WKx4J9k6Dz7bAMjKD8pHZJnScoP4 dzKPhrytN/iWM01eRZRc1TcIdVsRZC3hcVE6OtFoamaYmePDwWTRhmDtWYngbRDVGe3Tl8bT 7BYN7gv7Ikt7Nq2T2TOfXEQqr9CtidxBNsqFEaajbFvpLDpUPw692+4lUbQ7FL0B1WYLvWkG cVysClEyX3VBSMzIG5eTF0Dng9RqItUxpbD317ihKqYL95jk6eK6XyI8wVOCEa1V3MhtvzUo WGZVkwm9eMVZ05GbhzmT7KHBEBbCkihS+TpVxOgzvuV+heCEaaxIDWY/k8u4tgbrVVk+tIVG 99v1//kNLqd5KuwY1Y2/h2MhRrfxqGz+l/f/qghKh+1iptm6McN//1nNaIbzXQ2Ej34jeWDa xAN1C1OANOyV7mYuYPNDl5c9QrbcNGg3D6gOeGeGiMn11NjbjHae3ipH8MkX7/k8pH5q4Lhh Ra0vtJspeg77CS4b7+WC5jlK3UAKoUja3kGgkCrnfNkvKjrkEwARAQABzSZBbGV4YW5kZXIg UG9wb3YgPGFsZXgucG9wb3ZAbGludXguY29tPsLBgAQTAQoAKgIbIwIeAQIXgAULCQgHAwUV CgkICwUWAgMBAAUJB8+UXAUCWgsUegIZAQAKCRCODp3rvH6PqqpOEACX+tXHOgMJ6fGxaNJZ HkKRFR/9AGP1bxp5QS528Sd6w17bMMQ87V5NSFUsTMPMcbIoO73DganKQ3nN6tW0ZvDTKpRt pBUCUP8KPqNvoSs3kkskaQgNQ3FXv46YqPZ7DoYj9HevY9NUyGLwCTEWD2ER5zKuNbI2ek82 j4rwdqXn9kqqBf1ExAoEsszeNHzTKRl2d+bXuGDcOdpnOi7avoQfwi/O0oapR+goxz49Oeov YFf1EVaogHjDBREaqiqJ0MSKexfVBt8RD9ev9SGSIMcwfhgUHhMTX2JY/+6BXnUbzVcHD6HR EgqVGn/0RXfJIYmFsjH0Z6cHy34Vn+aqcGa8faztPnmkA/vNfhw8k5fEE7VlBqdEY8YeOiza hHdpaUi4GofNy/GoHIqpz16UulMjGB5SBzgsYKgCO+faNBrCcBrscWTl1aJfSNJvImuS1JhB EQnl/MIegxyBBRsH68x5BCffERo4FjaG0NDCmZLjXPOgMvl3vRywHLdDZThjAea3pwdGUq+W C77i7tnnUqgK7P9i+nEKwNWZfLpfjYgH5JE/jOgMf4tpHvO6fu4AnOffdz3kOxDyi+zFLVcz rTP5b46aVjI7D0dIDTIaCKUT+PfsLnJmP18x7dU/gR/XDcUaSEbWU3D9u61AvxP47g7tN5+a 5pFIJhJ44JLk6I5H/c7BTQRV9eauARAArcUVf6RdT14hkm0zT5TPc/3BJc6PyAghV/iCoPm8 kbzjKBIK80NvGodDeUV0MnQbX40jjFdSI0m96HNt86FtifQ3nwuW/BtS8dk8+lakRVwuTgMb hJWmXqKMFdVRCbjdyLbZWpdPip0WGND6p5i801xgPRmI8P6e5e4jBO4Cx1ToIFyJOzD/jvtb UhH9t5/naKUGa5BD9gSkguooXVOFvPdvKQKca19S7bb9hzjySh63H4qlbhUrG/7JGhX+Lr3g DwuAGrrFIV0FaVyIPGZ8U2fjLKpcBC7/lZJv0jRFpZ9CjHefILxt7NGxPB9hk2iDt2tE6jSl GNeloDYJUVItFmG+/giza2KrXmDEFKl+/mwfjRI/+PHR8PscWiB7S1zhsVus3DxhbM2mAK4x mmH4k0wNfgClh0Srw9zCU2CKJ6YcuRLi/RAAiyoxBb9wnSuQS5KkxoT32LRNwfyMdwlEtQGp WtC/vBI13XJVabx0Oalx7NtvRCcX1FX9rnKVjSFHX5YJ48heAd0dwRVmzOGL/EGywb1b9Q3O IWe9EFF8tmWV/JHs2thMz492qTHA5pm5JUsHQuZGBhBU+GqdOkdkFvujcNu4w7WyuEITBFAh 5qDiGkvY9FU1OH0fWQqVU/5LHNizzIYN2KjU6529b0VTVGb4e/M0HglwtlWpkpfQzHMAEQEA AcLBZQQYAQIADwUCVfXmrgIbDAUJCWYBgAAKCRCODp3rvH6PqrZtEACKsd/UUtpKmy4mrZwl 053nWp7+WCE+S9ke7CFytmXoMWf1CIrcQTk5cmdBmB4E0l3sr/DgKlJ8UrHTdRLcZZnbVqur +fnmVeQy9lqGkaIZvx/iXVYUqhT3+DNj9Zkjrynbe5pLsrGyxYWfsPRVL6J4mQatChadjuLw 7/WC6PBmWkRA2SxUVpxFEZlirpbboYWLSXk9I3JmS5/iJ+P5kHYiB0YqYkd1twFXXxixv1GB Zi/idvWTK7x6/bUh0AAGTKc5zFhyR4DJRGROGlFTAYM3WDoa9XbrHXsggJDLNoPZJTj9DMww u28SzHLvR3t2pY1dT61jzKNDLoE3pjvzgLKF/Olif0t7+m0IPKY+8umZvUEhJ9CAUcoFPCfG tEbL6t1xrcsT7dsUhZpkIX0Qc77op8GHlfNd/N6wZUt19Vn9G8B6xrH+dinc0ylUc4+4yxt6 6BsiEzma6Ah5jexChYIwaB5Oi21yjc6bBb4l6z01WWJQ052OGaOBzi+tS5iGmc5DWH4/pFqX OIkgJVVgjPv2y41qV66QJJEi2wT4WUKLY1zA9s6KXbt8dVSzJsNFvsrAoFdtzc8v6uqCo0/W f0Id8MBKoqN5FniTHWNxYX6b2dFwq8i5Rh6Oxc6q75Kg8279+co3/tLCkU6pGga28K7tUP2z h9AUWENlnWJX/YhP8MLBZQQYAQoADwIbDAUCWgsSOgUJB9eShwAKCRCODp3rvH6PqtoND/41 ozCKAS4WWBBCU6AYLm2SoJ0EGhg1kIf9VMiqy5PKlSrAnW5yl4WJQcv5wER/7EzvZ49Gj8aG uRWfz3lyQU8dH2KG6KLilDFCZF0mViEo2C7O4QUx5xmbpMUq41fWjY947Xvd3QDisc1T1/7G uNBAALEZdqzwnKsT9G27e9Cd3AW3KsLAD4MhsALFARg6OuuwDCbLl6k5fu++26PEqORGtpJQ rRBWan9ZWb/Y57P126IVIylWiH6vt6iEPlaEHBU8H9+Z0WF6wJ5rNz9gR6GhZhmo1qsyNedD 1HzOsXQhvCinsErpZs99VdZSF3d54dac8ypH4hvbjSmXZjY3Sblhyc6RLYlru5UXJFh7Hy+E TMuCg3hIVbdyFSDkvxVlvhHgUSf8+Uk3Ya4MO4a5l9ElUqxpSqYH7CvuwkG+mH5mN8tK3CCd +aKPCxUFfil62DfTa7YgLovr7sHQB+VMQkNDPXleC+amNqJb423L8M2sfCi9gw/lA1ha6q80 ydgbcFEkNjqz4OtbrSwEHMy/ADsUWksYuzVbw7/pQTc6OAskESBr5igP7B/rIACUgiIjdOVB ktD1IQcezrDcuzVCIpuq8zC6LwLm7V1Tr6zfU9FWwnqzoQeQZH4QlP7MBuOeswCpxIl07mz9 jXz/74kjFsyRgZA+d6a1pGtOwITEBxtxxg== Message-ID: <684dc732-88f0-31dd-c1ae-ba54a733abbb@linux.com> Date: Wed, 18 Apr 2018 16:00:23 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <20180418082319.wxxhwxwhblwh6llo@pengutronix.de> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 18.04.2018 11:23, Uwe Kleine-König wrote: > On Wed, Apr 18, 2018 at 10:56:03AM +0300, Alexander Popov wrote: >> On 18.04.2018 10:07, Uwe Kleine-König wrote: >>> Your commit log is wrong (and I think the patch, too). >> >> I believe this bug is not a memdup_user() issue. There is a nice selection from >> LKML discussions about ZERO_SIZE_PTR, which convinces me: >> http://yarchive.net/comp/linux/malloc_0.html > > Ack, no memdup_user problem. i2cdev_ioctl_rdwr() should not access > msgs[i].buf[0] if msgs[i].len is 0. > > But you should not prohibit i2c transfers with length 0 in general. Ok, thanks for that info. I should fix the patch. > So a better patch is the following: > > > diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c > index 036a03f0d0a6..0137538c36a0 100644 > --- a/drivers/i2c/i2c-dev.c > +++ b/drivers/i2c/i2c-dev.c > @@ -280,6 +280,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client, > */ > if (msgs[i].flags & I2C_M_RECV_LEN) { > if (!(msgs[i].flags & I2C_M_RD) || > + msgs[i].len < 1 || > msgs[i].buf[0] < 1 || > msgs[i].len < msgs[i].buf[0] + > I2C_SMBUS_BLOCK_MAX) { > > But having said that and after reading the comment above the if, I'm not > sure this is enough. I'll check that carefully and come back with the next version. Thanks! Alexander