From: Patrick Menschel <menschel.p@posteo.de>
To: Oliver Hartkopp <socketcan@hartkopp.net>,
Norbert Slusarek <nslusarek@gmx.net>
Cc: mkl@pengutronix.de, davem@davemloft.net, kuba@kernel.org,
linux-can@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH] can: bcm: fix infoleak in struct bcm_msg_head
Date: Sun, 13 Jun 2021 11:18:32 +0000 [thread overview]
Message-ID: <34cc6b6a-6eb0-f3ce-1864-9057b80fab9e@posteo.de> (raw)
In-Reply-To: <f9d008bc-2416-8032-0005-35d7c6d87fc1@hartkopp.net>
Am 13.06.21 um 11:51 schrieb Oliver Hartkopp:
>
>
> On 12.06.21 23:09, Norbert Slusarek wrote:
>> From: Norbert Slusarek <nslusarek@gmx.net>
>> Date: Sat, 12 Jun 2021 22:18:54 +0200
>> Subject: [PATCH] can: bcm: fix infoleak in struct bcm_msg_head
>>
>> On 64-bit systems, struct bcm_msg_head has an added padding of 4 bytes
>> between
>> struct members count and ival1. Even though all struct members are
>> initialized,
>> the 4-byte hole will contain data from the kernel stack. This patch
>> zeroes out
>> struct bcm_msg_head before usage, preventing infoleaks to userspace.
>>
>> Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
>> Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
>
> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
>
> Thanks Norbert!
>
> Yes, when this data structure was created in 2003 either 64 bit machines
> were far away for me and infoleaks were not a hot topic like today.
>
> Would be interesting to check where data structures are used in the
> Linux UAPI that became an infoleak in the 32-to-64-bit compilation
> transistion.
>
Hi,
1.
Are you sure this leak really happens on 64-bit and not on 32-bit instead?
I remember I got the problems with bcm msg head on the 32bit raspberry
pi because I missed the alignment by accident.
When I calculate the size of msg head on a Ryzen 1800X with Python
3.9.5, I get:
struct.calcsize("IIIllllII"),struct.calcsize("IIIllllII0q")
(56, 56)
First Value is raw, the second value is the alignment hack with the zero
length quad word "0q".
On the 32bit raspberry pi, same op results in the gap.
struct.calcsize("IIIllllII"),struct.calcsize("IIIllllII0q")
(36, 40)
2.
Finding stucts with non-zero-ed gaps should be easy with a skript or
even better with a GCC directive. I believe Syzbot does such a thing too.
Kind Regards,
Patrick Menschel
next prev parent reply other threads:[~2021-06-13 11:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-12 21:09 [PATCH] can: bcm: fix infoleak in struct bcm_msg_head Norbert Slusarek
2021-06-13 9:51 ` Oliver Hartkopp
2021-06-13 11:18 ` Patrick Menschel [this message]
2021-06-13 13:35 ` Norbert Slusarek
2021-06-13 15:36 ` Patrick Menschel
2021-06-13 18:33 ` Norbert Slusarek
2021-06-14 7:20 ` Marc Kleine-Budde
2021-06-15 20:40 ` Norbert Slusarek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=34cc6b6a-6eb0-f3ce-1864-9057b80fab9e@posteo.de \
--to=menschel.p@posteo.de \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=nslusarek@gmx.net \
--cc=socketcan@hartkopp.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.