Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp427641ybi; Fri, 31 May 2019 03:49:02 -0700 (PDT) X-Google-Smtp-Source: APXvYqylFw47r9ecPCV6M1gZ214N+4GMfHOoO2Ylscst0kASYG9if0UcaaM0p9ltoEYyLffHiKil X-Received: by 2002:a17:902:a98b:: with SMTP id bh11mr8437822plb.8.1559299742333; Fri, 31 May 2019 03:49:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1559299742; cv=none; d=google.com; s=arc-20160816; b=RSMpxyhCjGQUktoE67QZcmCoNoemAlPsn1pSHivhAQvK7KOkc5hdZfMpnh3nqEdwGi ctmTtoVu+Vn1s7yuXx8/jyo1n7Ivmuc/HWAysM/7aHzfP3p4q3AtZXNxqZqO20yLVmxV Q9oem2+Xd9LgX3MoKyssMXxE4Y3KWnuJTUpioOMRlpT6BCTh3p9SXouI1bLnJyQ7U93U 2wTQLs7Vpc2D57Z66onC3OuYGls9ObIB5qiTkmaWmOQ9xNEI5TrM4gUsCXog6UY55GXP 4p+ZW/+wzvrubXWXuay7mI9iJYezAbgR/Umlm6JVUOn2Hrsq2yu5k+ELvUVb5mFd2pKB Nk7Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:mime-version:user-agent:date:message-id:subject :autocrypt:openpgp:from:cc:to; bh=9eypdWBZ7MPm7vnKhsT8a2X/HmeOxsYc8uMwhDiF4k4=; b=H1D/j5yKddd2gxnaNoThVDgZgq1NyPi9LoqhlIEUgUPzF5iaiOQ17+vaunLYIafGgo zJ2gB5A3yGxAYGEgi+J2Eq+PYoX8c9L2WZ6LsUPHbeA3jUUE1s28crcZITQ9CvRmEy1p cxFy31bL0tywiHgoY591ZzRMGqDuc9D/4EGUbshxomryciuPs+rPMCZQzMdnspqFE+NN d7o6XOKK72BG8Fpa8rzE1E30n8thmjVDxqFEW07SM5Qexld2BEgvErH7n0TqYm8kjD5F ybk3oOrgOnUuofnO1aDWYjsAuCE7IwUlUd5lcdR2CN8wwpIm1M2EnYtalRYtI1gAyMjS 69QQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h3si5186421pgq.33.2019.05.31.03.48.44; Fri, 31 May 2019 03:49:02 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727053AbfEaKqb (ORCPT + 99 others); Fri, 31 May 2019 06:46:31 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:44632 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726158AbfEaKqb (ORCPT ); Fri, 31 May 2019 06:46:31 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212]) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1hWf3N-0003fL-Rn; Fri, 31 May 2019 10:46:29 +0000 To: Ke Wu , James Morris , Kees Cook , "Serge E. Hallyn" , linux-security-module@vger.kernel.org Cc: "linux-kernel@vger.kernel.org" From: Colin Ian King Openpgp: preference=signencrypt Autocrypt: addr=colin.king@canonical.com; prefer-encrypt=mutual; keydata= mQINBE6TJCgBEACo6nMNvy06zNKj5tiwDsXXS+LhT+LwtEsy9EnraKYXAf2xwazcICSjX06e fanlyhB0figzQO0n/tP7BcfMVNG7n1+DC71mSyRK1ZERcG1523ajvdZOxbBCTvTitYOy3bjs +LXKqeVMhK3mRvdTjjmVpWnWqJ1LL+Hn12ysDVVfkbtuIm2NoaSEC8Ae8LSSyCMecd22d9Pn LR4UeFgrWEkQsqROq6ZDJT9pBLGe1ZS0pVGhkRyBP9GP65oPev39SmfAx9R92SYJygCy0pPv BMWKvEZS/7bpetPNx6l2xu9UvwoeEbpzUvH26PHO3DDAv0ynJugPCoxlGPVf3zcfGQxy3oty dNTWkP6Wh3Q85m+AlifgKZudjZLrO6c+fAw/jFu1UMjNuyhgShtFU7NvEzL3RqzFf9O1qM2m uj83IeFQ1FZ65QAiCdTa3npz1vHc7N4uEQBUxyXgXfCI+A5yDnjHwzU0Y3RYS52TA3nfa08y LGPLTf5wyAREkFYou20vh5vRvPASoXx6auVf1MuxokDShVhxLpryBnlKCobs4voxN54BUO7m zuERXN8kadsxGFzItAyfKYzEiJrpUB1yhm78AecDyiPlMjl99xXk0zs9lcKriaByVUv/NsyJ FQj/kmdxox3XHi9K29kopFszm1tFiDwCFr/xumbZcMY17Yi2bQARAQABtCVDb2xpbiBLaW5n IDxjb2xpbi5raW5nQGNhbm9uaWNhbC5jb20+iQI2BBMBCAAhBQJOkyQoAhsDBQsJCAcDBRUK CQgLBRYCAwEAAh4BAheAAAoJEGjCh9/GqAImsBcP9i6C/qLewfi7iVcOwqF9avfGzOPf7CVr n8CayQnlWQPchmGKk6W2qgnWI2YLIkADh53TS0VeSQ7Tetj8f1gV75eP0Sr/oT/9ovn38QZ2 vN8hpZp0GxOUrzkvvPjpH+zdmKSaUsHGp8idfPpZX7XeBO0yojAs669+3BrnBcU5wW45SjSV nfmVj1ZZj3/yBunb+hgNH1QRcm8ZPICpjvSsGFClTdB4xu2AR28eMiL/TTg9k8Gt72mOvhf0 fS0/BUwcP8qp1TdgOFyiYpI8CGyzbfwwuGANPSupGaqtIRVf+/KaOdYUM3dx/wFozZb93Kws gXR4z6tyvYCkEg3x0Xl9BoUUyn9Jp5e6FOph2t7TgUvv9dgQOsZ+V9jFJplMhN1HPhuSnkvP 5/PrX8hNOIYuT/o1AC7K5KXQmr6hkkxasjx16PnCPLpbCF5pFwcXc907eQ4+b/42k+7E3fDA Erm9blEPINtt2yG2UeqEkL+qoebjFJxY9d4r8PFbEUWMT+t3+dmhr/62NfZxrB0nTHxDVIia u8xM+23iDRsymnI1w0R78yaa0Eea3+f79QsoRW27Kvu191cU7QdW1eZm05wO8QUvdFagVVdW Zg2DE63Fiin1AkGpaeZG9Dw8HL3pJAJiDe0KOpuq9lndHoGHs3MSa3iyQqpQKzxM6sBXWGfk EkK5Ag0ETpMkKAEQAMX6HP5zSoXRHnwPCIzwz8+inMW7mJ60GmXSNTOCVoqExkopbuUCvinN 4Tg+AnhnBB3R1KTHreFGoz3rcV7fmJeut6CWnBnGBtsaW5Emmh6gZbO5SlcTpl7QDacgIUuT v1pgewVHCcrKiX0zQDJkcK8FeLUcB2PXuJd6sJg39kgsPlI7R0OJCXnvT/VGnd3XPSXXoO4K cr5fcjsZPxn0HdYCvooJGI/Qau+imPHCSPhnX3WY/9q5/WqlY9cQA8tUC+7mgzt2VMjFft1h rp/CVybW6htm+a1d4MS4cndORsWBEetnC6HnQYwuC4bVCOEg9eXMTv88FCzOHnMbE+PxxHzW 3Gzor/QYZGcis+EIiU6hNTwv4F6fFkXfW6611JwfDUQCAHoCxF3B13xr0BH5d2EcbNB6XyQb IGngwDvnTyKHQv34wE+4KtKxxyPBX36Z+xOzOttmiwiFWkFp4c2tQymHAV70dsZTBB5Lq06v 6nJs601Qd6InlpTc2mjd5mRZUZ48/Y7i+vyuNVDXFkwhYDXzFRotO9VJqtXv8iqMtvS4xPPo 2DtJx6qOyDE7gnfmk84IbyDLzlOZ3k0p7jorXEaw0bbPN9dDpw2Sh9TJAUZVssK119DJZXv5 2BSc6c+GtMqkV8nmWdakunN7Qt/JbTcKlbH3HjIyXBy8gXDaEto5ABEBAAGJAh8EGAEIAAkF Ak6TJCgCGwwACgkQaMKH38aoAiZ4lg/+N2mkx5vsBmcsZVd3ys3sIsG18w6RcJZo5SGMxEBj t1UgyIXWI9lzpKCKIxKx0bskmEyMy4tPEDSRfZno/T7p1mU7hsM4owi/ic0aGBKP025Iok9G LKJcooP/A2c9dUV0FmygecRcbIAUaeJ27gotQkiJKbi0cl2gyTRlolKbC3R23K24LUhYfx4h pWj8CHoXEJrOdHO8Y0XH7059xzv5oxnXl2SD1dqA66INnX+vpW4TD2i+eQNPgfkECzKzGj+r KRfhdDZFBJj8/e131Y0t5cu+3Vok1FzBwgQqBnkA7dhBsQm3V0R8JTtMAqJGmyOcL+JCJAca 3Yi81yLyhmYzcRASLvJmoPTsDp2kZOdGr05Dt8aGPRJL33Jm+igfd8EgcDYtG6+F8MCBOult TTAu+QAijRPZv1KhEJXwUSke9HZvzo1tNTlY3h6plBsBufELu0mnqQvHZmfa5Ay99dF+dL1H WNp62+mTeHsX6v9EACH4S+Cw9Q1qJElFEu9/1vFNBmGY2vDv14gU2xEiS2eIvKiYl/b5Y85Q QLOHWV8up73KK5Qq/6bm4BqVd1rKGI9un8kezUQNGBKre2KKs6wquH8oynDP/baoYxEGMXBg GF/qjOC6OY+U7kNUW3N/A7J3M2VdOTLu3hVTzJMZdlMmmsg74azvZDV75dUigqXcwjE= Subject: re: security/loadpin: Allow to exclude specific file types Message-ID: <73fac64c-fe49-4738-49a4-0afe668eed94@canonical.com> Date: Fri, 31 May 2019 11:46:29 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Static analysis with Coverity on linux-next has found a potential issue with the following commit: commit 1633a4f04cc171fc638deb5c95af96032d3c591b Author: Ke Wu Date: Thu May 30 12:22:08 2019 -0700 security/loadpin: Allow to exclude specific file types 209 for (j = 0; j < ARRAY_SIZE(kernel_read_file_str); j++) { 210 if (strcmp(cur, kernel_read_file_str[j]) == 0) { 211 pr_info("excluding: %s\n", 212 kernel_read_file_str[j]); CID 81977 (#1 of 1): Out-of-bounds write overrun-local: Overrunning array ignore_read_file_id of 8 4-byte elements at element index 8 (byte offset 35) using index j (which evaluates to 8). 213 ignore_read_file_id[j] = 1; According to Coverity ignore_read_file_id is an array of 8 integers. However, ARRAY_SIZE(kernel_read_file_str) is 9, so we have an out of bounds write on ignore_read_file[j] when j is 8. Colin