Re: [PATCH v2] sctp: don't dereference ptr before leaving _sctp_walk_{params,errors}()

From: Alexander Potapenko <glider@google.com>
Date: Fri, 14 Jul 2017 19:33:54 +0200

On Fri, Jul 14, 2017 at 7:23 PM, David Miller [off-list ref] wrote:

quoted

From: Alexander Potapenko <glider@google.com>
Date: Fri, 14 Jul 2017 18:33:01 +0200

quoted

On Fri, Jul 14, 2017 at 5:58 PM, David Miller [off-list ref] wrote:

quoted

From: Alexander Potapenko <glider@google.com>
Date: Fri, 14 Jul 2017 12:03:29 +0200

quoted

 v2: per comment from David Miller, make sure the whole iterator->length
     fits into the remaining buffer.

Please compile and functionally test your changes:

In file included from ./include/linux/compiler.h:58:0,
                 from ./include/uapi/linux/stddef.h:1,
                 from ./include/linux/stddef.h:4,
                 from ./include/uapi/linux/posix_types.h:4,
                 from ./include/uapi/linux/types.h:13,
                 from ./include/linux/types.h:5,
                 from net/sctp/sm_statefuns.c:48:
net/sctp/sm_statefuns.c: In function ‘sctp_sf_do_reconf’:
./include/net/sctp/sctp.h:472:24: error: unknown type name ‘sctp_paramhdr_t’
      (pos.v + offsetof(sctp_paramhdr_t, length) + sizeof(pos.p->length) <\
                        ^

Oops. Fixed.

Did you functionally test the new version or just do a quick compile
check and resubmit?

I've checked that the kernel still works, but unfortunately I couldn't
check whether or not this affected the uninit memory, as KMSAN
currently works on a fixed kernel revision. The compilation error was
actually caused by me failing to test the kernel when porting the fix
from that revision to upstream.

quoted

I really want you to test this if the logic has been changed.

Do you mean any specific tests in addition to, say, running the
reproducer on which the uninit use was reported?

I mean the reproducer.