KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace 1-element array in fs/dlm/dlm_internal.h #228

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago

Replace one-element array with flexible-array member in fs/dlm/dlm_internal.h

551 /*
552  * The max number of resources per rsbtbl bucket that shrink will attempt
553  * to remove in each iteration.
554  */
555 
556 #define DLM_REMOVE_NAMES_MAX 8
557 
558 struct dlm_ls {
559         struct list_head        ls_list;        /* list of lockspaces */
...
669         const struct dlm_lockspace_ops *ls_ops;
670         void                    *ls_ops_arg;
671 
672         int                     ls_namelen;
673         char                    ls_name[1];
674 };

Audit (at least) all these places where the flex array is being used:

diff -u -p ./fs/dlm/lockspace.c /tmp/nothing/fs/dlm/lockspace.c
--- ./fs/dlm/lockspace.c
+++ /tmp/nothing/fs/dlm/lockspace.c
@@ -220,7 +220,6 @@ static int dlm_uevent(struct kobject *ko
 {
        struct dlm_ls *ls = container_of(kobj, struct dlm_ls, ls_kobj);

-       add_uevent_var(env, "LOCKSPACE=%s", ls->ls_name);
        return 0;
 }

@@ -455,7 +454,6 @@ static int new_lockspace(const char *nam
                WARN_ON(ls->ls_create_count <= 0);
                if (ls->ls_namelen != namelen)
                        continue;
-               if (memcmp(ls->ls_name, name, namelen))
                        continue;
                if (flags & DLM_LSFL_NEWEXCL) {
                        error = -EEXIST;
@@ -476,7 +474,6 @@ static int new_lockspace(const char *nam
        ls = kzalloc(sizeof(struct dlm_ls) + namelen, GFP_NOFS);
        if (!ls)
                goto out;
-       memcpy(ls->ls_name, name, namelen);
        ls->ls_namelen = namelen;
        ls->ls_lvblen = lvblen;
        atomic_set(&ls->ls_count, 0);
@@ -646,7 +643,6 @@ static int new_lockspace(const char *nam

        ls->ls_kobj.kset = dlm_kset;
        error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL,
-                                    "%s", ls->ls_name);
        if (error)
                goto out_recoverd;
        kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
PauloMigAlmeida commented 1 year ago

Hi @GustavoARSilva , I've been meaning to start contributing to the KSPP project. Could you assign this task to me? (or even you think that there is a more suitable first issue, feel free to assign that one to me).

I just want to make sure I'm not gonna be working on something that you are currently looking at.

I will drop an 'self-introduction' to the mailing list later today to share my skills and time commitment that I'm willing to dedicate to this project.

Thanks!

GustavoARSilva commented 1 year ago

Hi @GustavoARSilva , I've been meaning to start contributing to the KSPP project. Could you assign this task to me? (or even you think that there is a more suitable first issue, feel free to assign that one to me).

Awesome. Go for it. :)

We have a "good first issue" tag for those we consider are more trivial issues to address. You can check them out and decide if you want to start there.

Thanks

Gustavo

PauloMigAlmeida commented 1 year ago

Patch for this: https://lore.kernel.org/linux-hardening/Y0ICbf8tCtXMn+W0@mail.google.com/T/#u

PauloMigAlmeida commented 1 year ago

I got betrayed by a fat finger mistake (which messed up the body of my previous patch) 🤦🏻 .

Patch v2 for this: https://lore.kernel.org/linux-hardening/Y0IFEUjwXGZFf7bB@mail.google.com/T/#u

PauloMigAlmeida commented 1 year ago

Patch has been accepted