lm: fix invalid free
>> > dlm: don't allow zero length names
>> > dlm: don't leak kernel pointer to userspace
>> >
>> > fs/dlm/lockspace.c | 2 +-
>> > fs/dlm/member.c| 5 +++--
>> > fs/dlm/user.c | 2 +-
>> > 3 files changed, 5 insertions(+), 4 deletions(-)
>>
>> I've pushed these to linux-dlm next.
>
> Great, thanks! Should we send 1 and 3 to stable?
Yes please! :)
--
Kees Cook
ngs are supposed to warn about issues that could
> be bugs. Falling through to default: break; can hardly be a bug?!
It's certainly a place where the intent is not always clear. I think
this makes all the cases unambiguous, and doesn't impact the machine
code, since the compiler will happily optimize away any behavioral
redundancy.
--
Kees Cook
On Fri, Nov 20, 2020 at 11:51:42AM -0800, Jakub Kicinski wrote:
> On Fri, 20 Nov 2020 11:30:40 -0800 Kees Cook wrote:
> > On Fri, Nov 20, 2020 at 10:53:44AM -0800, Jakub Kicinski wrote:
> > > On Fri, 20 Nov 2020 12:21:39 -0600 Gustavo A. R. Silva wrote:
> > > > This
On Fri, Nov 20, 2020 at 11:51:42AM -0800, Jakub Kicinski wrote:
> On Fri, 20 Nov 2020 11:30:40 -0800 Kees Cook wrote:
> > On Fri, Nov 20, 2020 at 10:53:44AM -0800, Jakub Kicinski wrote:
> > > On Fri, 20 Nov 2020 12:21:39 -0600 Gustavo A. R. Silva wrote:
> > > > This
On Mon, Nov 23, 2020 at 05:32:51PM -0800, Nick Desaulniers wrote:
> On Sun, Nov 22, 2020 at 8:17 AM Kees Cook wrote:
> >
> > On Fri, Nov 20, 2020 at 11:51:42AM -0800, Jakub Kicinski wrote:
> > > If none of the 140 patches here fix a real bug, and there is no change
>
inal series may be lower, but there
are still bugs being found from it -- we need to finish this and shut
the door on it for good.)
--
Kees Cook
-through
All switch/case blocks must end in one of:
break;
fallthrough;
continue;
goto ;
return [expression];
[3] https://cwe.mitre.org/data/definitions/484.html
--
Kees Cook
tances of open-coded pointer math with container_of()
usage, and update the allocator to match.
Reported-by: kernel test robot
Link: https://lore.kernel.org/lkml/202205041550.nakxwcbj-...@intel.com
Cc: Bob Peterson
Cc: Andreas Gruenbacher
Cc: Bill Wendling
Cc: cluster-devel@redhat.com
Signed-o
> > > + return container_of(mapping, struct glock_aspace,
> > > mapping)->glock.gl_name.ln_sbd;
> >
> > A local variable would be really nice for the reader here to decompose
> > this a bit:
> >
> > struct glock_aspace *a =
> > container_of(mapping, struct glock_aspace, mapping);
> >
> > return a->glock.gl_name.ln_sbd;
>
> Yes.
Thanks! So I should leave this with you to arrange, or should I send an
updated patch?
--
Kees Cook
On Tue, May 10, 2022 at 06:16:30PM +0200, Andreas Gruenbacher wrote:
> Kees,
>
> On Tue, May 10, 2022 at 5:51 PM Kees Cook wrote:
> > Thanks! So I should leave this with you to arrange, or should I send an
> > updated patch?
>
> are you happy with this?
>
> htt
https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keesc...@chromium.org/
Cc: Christine Caulfield
Cc: David Teigland
Cc: cluster-devel@redhat.com
Reported-by: "Gustavo A. R. Silva"
Signed-off-by: Kees Cook
---
fs/dlm/requestqueue.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion
e didn't
change. But this has always allocated too much space, due to the struct
padding. For a "no binary changes" patch, the above "+ 1" needs to be left off.
I would expect the correct allocation size to be:
offsetof(typeof(*ls), ls_name) + namelen
Question, though: is ls_name _expected_ to be %NUL terminated, and was the
prior 3 bytes of extra allocation accidentally required?
-Kees
--
Kees Cook
On Sun, Oct 09, 2022 at 03:05:17PM +1300, Paulo Miguel Almeida wrote:
> On Sat, Oct 08, 2022 at 05:18:35PM -0700, Kees Cook wrote:
> > This is allocating 1 more byte than before, since the struct size didn't
> > change. But this has always allocated too much space, due to the
On Mon, Oct 10, 2022 at 04:00:39PM -0500, David Teigland wrote:
> On Sat, Oct 08, 2022 at 09:03:28PM -0700, Kees Cook wrote:
> > On Sun, Oct 09, 2022 at 03:05:17PM +1300, Paulo Miguel Almeida wrote:
> > > On Sat, Oct 08, 2022 at 05:18:35PM -0700, Kees Cook wrote:
> > >
ing the right version number. Req: Gustavo Silva
> v3: replace one-element array with a fixed size array. Req: Kees Cook
> v2: patch resent as I had an issue with a char in my mail client
> v1: https://lore.kernel.org/lkml/y0icbf8tctxmn...@mail.google.com/
> ---
> fs/dlm/dlm_internal.h
ssues/79
> Link: https://github.com/KSPP/linux/issues/228
> Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836
> Link: https://lore.kernel.org/lkml/y0w5jkixukpnl...@mail.google.com/
>
> Signed-off-by: Paulo Miguel Almeida
Reviewed-by: Kees Cook
--
Kees Cook
gned-off-by: Azeem Shaikh
Reviewed-by: Kees Cook
--
Kees Cook
ffort to remove strlcpy() completely [2], replace
> strlcpy() here with strscpy().
> No return values were used, so direct replacement is safe.
>
> [...]
Applied to for-next/hardening, thanks!
[1/1] dlm: Replace all non-returning strlcpy with strscpy
https://git.kernel.org/kees/c/30ad0627f169
--
Kees Cook
18 matches
Mail list logo
