diff options
author | Wenwen Wang <wang6495@umn.edu> | 2018-10-03 11:43:59 -0500 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2019-02-11 17:53:38 +0000 |
commit | 6be632e793cad65a603692d1e4fc59e619478cdc (patch) | |
tree | 82bd30e94925f9e7de749727ce18b04b624ba086 /drivers/clk | |
parent | 462eb41b96186af140f1117994ea6c21cedd6fd8 (diff) | |
download | linux-stable-6be632e793cad65a603692d1e4fc59e619478cdc.tar.gz linux-stable-6be632e793cad65a603692d1e4fc59e619478cdc.tar.bz2 linux-stable-6be632e793cad65a603692d1e4fc59e619478cdc.zip |
dm ioctl: harden copy_params()'s copy_from_user() from malicious users
commit 800a7340ab7dd667edf95e74d8e4f23a17e87076 upstream.
In copy_params(), the struct 'dm_ioctl' is first copied from the user
space buffer 'user' to 'param_kernel' and the field 'data_size' is
checked against 'minimum_data_size' (size of 'struct dm_ioctl' payload
up to its 'data' member). If the check fails, an error code EINVAL will be
returned. Otherwise, param_kernel->data_size is used to do a second copy,
which copies from the same user-space buffer to 'dmi'. After the second
copy, only 'dmi->data_size' is checked against 'param_kernel->data_size'.
Given that the buffer 'user' resides in the user space, a malicious
user-space process can race to change the content in the buffer between
the two copies. This way, the attacker can inject inconsistent data
into 'dmi' (versus previously validated 'param_kernel').
Fix redundant copying of 'minimum_data_size' from user-space buffer by
using the first copy stored in 'param_kernel'. Also remove the
'data_size' check after the second copy because it is now unnecessary.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/clk')
0 files changed, 0 insertions, 0 deletions