kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning()

Prevent use of uninitialized memory (originating from the stack frame of do_sysctl()) by verifying that the name array is filled with sufficient input data before comparing its specific entries with integer constants. Through timing measurement or analyzing the kernel debug logs, a user-mode program could potentially infer the results of comparisons against the uninitialized memory, and acquire some (very limited) information about the state of the kernel stack. The change also eliminates possible future warnings by tools such as KMSAN and other code checkers / instrumentations.

Mateusz Jurczyk committed 9 years ago

Commit 9380fa61 parent 7c43a651 file · +1 −1Browse files

Showing the changes to kernel/sysctl_binary.c (1 of 1 file). Show all

Unified · Split

kernel/sysctl_binary.c+1−1

@@ -1346,7 +1346,7 @@ static void deprecated_sysctl_warning(const int *name, int nlen) · 1345 unmodified lines
1346	1346	* CTL_KERN/KERN_VERSION is used by older glibc and cannot
1347	1347	* ever go away.
1348	1348	*/
1349		− if (name[0] == CTL_KERN && name[1] == KERN_VERSION)
	1349	+ if (nlen >= 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION)
1350	1350	return;
1351	1351
1352	1352	if (printk_ratelimit()) {