lkml.org 
[lkml]   [2020]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 095/191] samples/seccomp: Zero out members based on seccomp_notif_sizes
    Date
    From: Sargun Dhillon <sargun@sargun.me>

    commit 771b894f2f3dfedc2ba5561731fffa0e39b1bbb6 upstream.

    The sizes by which seccomp_notif and seccomp_notif_resp are allocated are
    based on the SECCOMP_GET_NOTIF_SIZES ioctl. This allows for graceful
    extension of these datastructures. If userspace zeroes out the
    datastructure based on its version, and it is lagging behind the kernel's
    version, it will end up sending trailing garbage. On the other hand,
    if it is ahead of the kernel version, it will write extra zero space,
    and potentially cause corruption.

    Signed-off-by: Sargun Dhillon <sargun@sargun.me>
    Suggested-by: Tycho Andersen <tycho@tycho.ws>
    Link: https://lore.kernel.org/r/20191230203503.4925-1-sargun@sargun.me
    Fixes: fec7b6690541 ("samples: add an example of seccomp user trap")
    Cc: stable@vger.kernel.org
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    samples/seccomp/user-trap.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/samples/seccomp/user-trap.c
    +++ b/samples/seccomp/user-trap.c
    @@ -298,14 +298,14 @@ int main(void)
    req = malloc(sizes.seccomp_notif);
    if (!req)
    goto out_close;
    - memset(req, 0, sizeof(*req));

    resp = malloc(sizes.seccomp_notif_resp);
    if (!resp)
    goto out_req;
    - memset(resp, 0, sizeof(*resp));
    + memset(resp, 0, sizes.seccomp_notif_resp);

    while (1) {
    + memset(req, 0, sizes.seccomp_notif);
    if (ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, req)) {
    perror("ioctl recv");
    goto out_resp;

    \
     
     \ /
      Last update: 2020-01-07 22:11    [W:4.331 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site