Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 20 Oct 2018 20:21:19 -0700
User-Agent: K-9 Mail for Android
In-Reply-To: <1540051091-16604-1-git-send-email-wang6495@umn.edu>
References: <1540051091-16604-1-git-send-email-wang6495@umn.edu>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PATCH] net: socket: fix a missing-check bug
To:     Wenwen Wang <wang6495@umn.edu>
CC:     Kangjie Lu <kjlu@umn.edu>, "David S. Miller" <davem@davemloft.net>,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
From:   Florian Fainelli <f.fainelli@gmail.com>
Message-ID: <F93F08E0-9D18-4C1A-8214-8AEAC829B317@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Wenwen,

On October 20, 2018 8:58:10 AM PDT, Wenwen Wang <wang6495@umn=2Eedu> wrote=
:
>In ethtool_ioctl(), the ioctl command is firstly obtained from the
>user-space buffer 'compat_rxnfc' through get_user() and saved to
>'ethcmd'=2E
>Then, 'ethcmd' is checked to see whether it is necessary to pre-process
>the
>ethool structure, because the structure ethtool_rxnfc is defined with
>padding, as mentioned in the comment=2E If yes, a user-space buffer
>'rxnfc'
>is allocated through compat_alloc_user_space() and then the data in the
>original buffer 'compat_rxnfc' is copied to 'rxnfc' through
>copy_in_user(),
>including the ioctl command=2E It is worth noting that after this copy,
>there
>is no check enforced on the copied ioctl command=2E That means it is
>possible
>that 'rxnfc->cmd' is different from 'ethcmd', because a malicious user
>can
>race to modify the ioctl command in 'compat_rxnfc' between these two
>copies=2E Eventually, the ioctl command in 'rxnfc' will be used in
>dev_ethtool()=2E This can cause undefined behavior of the kernel and
>introduce potential security risk=2E
>
>This patch avoids the above issue by rewriting 'rxnfc->cmd' using
>'ethcmd'
>after copy_in_user()=2E
>
>Signed-off-by: Wenwen Wang <wang6495@umn=2Eedu>

Assuming these issues are found with some kind of automated analysis, can =
you also add in your work flow to provide a Fixes: tag such that this could=
 be backported to stable kernels?

If this is found by a tool is this something that is open source and someh=
ow available? I would also make it clear that these issues are typically na=
med time TOCTOU which might be clearer for people who review those patches=
=2E

Thanks!
--=20
Florian