Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:45 PM, Joe Perches wrote: > On Wed, 2013-09-11 at 12:25 -0700, Kees Cook wrote: >> On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches wrote: >> > On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: >> >> On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter >> >> wrote: >> >> >

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Joe Perches
On Wed, 2013-09-11 at 12:25 -0700, Kees Cook wrote: > On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches wrote: > > On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: > >> On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter > >> wrote: > >> > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: >

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches wrote: > On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: >> On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter >> wrote: >> > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: >> >> In the former case, format characters will get processed

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
> * %n is ignored Really it should trigger a WARN_ON_ONCE(). There is code like show_console_dev() which relies on it to work. If we ignore %n it causes another bug. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:22 PM, Dan Carpenter wrote: > On Wed, Sep 11, 2013 at 11:19:11AM -0700, Kees Cook wrote: >> On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter >> wrote: >> > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: >> >> In the former case, format characters will get

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Joe Perches
On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: > On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter > wrote: > > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: > >> In the former case, format characters will get processed by the > >> sprintf logic. In the latter, they are printed

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
On Wed, Sep 11, 2013 at 11:19:11AM -0700, Kees Cook wrote: > On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter > wrote: > > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: > >> In the former case, format characters will get processed by the > >> sprintf logic. In the latter, they are

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter wrote: > On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: >> In the former case, format characters will get processed by the >> sprintf logic. In the latter, they are printed as-is. In this specific >> case, if there was a way to inject

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: > In the former case, format characters will get processed by the > sprintf logic. In the latter, they are printed as-is. In this specific > case, if there was a way to inject strings like "ohai %n" into the > msgbuf string, the former

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former case, format characters will get processed by the sprintf logic. In the latter, they are printed as-is. In this specific case, if there was a way to inject strings like ohai %n into the msgbuf string, the former would

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former case, format characters will get processed by the sprintf logic. In the latter, they are printed as-is. In this specific case, if there was a

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Joe Perches
On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former case, format characters will get processed by the sprintf logic. In the latter, they

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
On Wed, Sep 11, 2013 at 11:19:11AM -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former case, format characters will get processed by the sprintf logic. In the

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:22 PM, Dan Carpenter dan.carpen...@oracle.com wrote: On Wed, Sep 11, 2013 at 11:19:11AM -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Dan Carpenter
* %n is ignored Really it should trigger a WARN_ON_ONCE(). There is code like show_console_dev() which relies on it to work. If we ignore %n it causes another bug. regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches j...@perches.com wrote: On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM -0700, Kees Cook wrote: In the former case, format

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Joe Perches
On Wed, 2013-09-11 at 12:25 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches j...@perches.com wrote: On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter dan.carpen...@oracle.com wrote: On Tue, Sep 10, 2013 at 10:19:17PM

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-11 Thread Kees Cook
On Wed, Sep 11, 2013 at 12:45 PM, Joe Perches j...@perches.com wrote: On Wed, 2013-09-11 at 12:25 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 12:09 PM, Joe Perches j...@perches.com wrote: On Wed, 2013-09-11 at 11:19 -0700, Kees Cook wrote: On Wed, Sep 11, 2013 at 2:31 AM, Dan Carpenter

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Kees Cook
On Tue, Sep 10, 2013 at 10:00 PM, Joe Perches wrote: > On Tue, 2013-09-10 at 21:41 -0700, Kees Cook wrote: >> Make sure that format strings cannot leak into printk() calls from the >> msgbuf string. > > printf(string); > vs > printf("%s", string); > > How does this help? In the

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Joe Perches
On Tue, 2013-09-10 at 21:41 -0700, Kees Cook wrote: > Make sure that format strings cannot leak into printk() calls from the > msgbuf string. printf(string); vs printf("%s", string); How does this help? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel"

[PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Kees Cook
Make sure that format strings cannot leak into printk() calls from the msgbuf string. Signed-off-by: Kees Cook --- drivers/staging/dgnc/dgnc_driver.c |4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/dgnc/dgnc_driver.c

[PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Kees Cook
Make sure that format strings cannot leak into printk() calls from the msgbuf string. Signed-off-by: Kees Cook keesc...@chromium.org --- drivers/staging/dgnc/dgnc_driver.c |4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/dgnc/dgnc_driver.c

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Joe Perches
On Tue, 2013-09-10 at 21:41 -0700, Kees Cook wrote: Make sure that format strings cannot leak into printk() calls from the msgbuf string. printf(string); vs printf(%s, string); How does this help? -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the

Re: [PATCH] staging: dgnc: fix potential format string flaw

2013-09-10 Thread Kees Cook
On Tue, Sep 10, 2013 at 10:00 PM, Joe Perches j...@perches.com wrote: On Tue, 2013-09-10 at 21:41 -0700, Kees Cook wrote: Make sure that format strings cannot leak into printk() calls from the msgbuf string. printf(string); vs printf(%s, string); How does this help? In