From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1900785-1527164281-2-11858967218026071911 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, MAILING_LIST_MULTI -1, RCVD_IN_DNSWL_HI -5, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='org', MailFrom='org' X-Spam-charsets: plain='UTF-8' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm2; t= 1527164280; b=VU1ruVji+tpQHEG9thmKPMjqKAm587gYgrAqCZD+MTFB823aZ7 LXQpm5BpMJf9CMX1dMLbeP5qSmUPjOZfvy2dj2UGSLikm4c0ErEdHuRPDCQDYDHK zyI+aMSnKLP75zIQSNOxbC0hFiVIoRm5ed61v0CX5Ab52QuwoB4KQULmGbhkRhhe KH9G9T6QfWQp/c/bq/yq1EwE7UD7PfsZM9m18JGxqK40kYsZiLMCoIAnM+JdPIgD 8swShK2ZdsI6Np24TB+4P6ffSGLYo3KBDhgTEvS8jKB+SD8NMqjv1KkHnjwjrKW4 fIRIaCXO41DWB4Pr+nUh4gmPRR9BRToWwXPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-type:sender :list-id; s=fm2; t=1527164280; bh=nHkXPnsOx42N3ORI0Y/txcL8i0CWVM A/HmpzW943MeI=; b=Pc0yK62CsZQXt6TR4QOv7c+4VpDVpooaHkVYc22jxgtXAT gZExFFlFcPfMgQqu/aTIYKYcu9nLXXFMaHOBWihOr6SJyoDq1L12MoFQ8N9B5ANx VljEMC2A6WclZMZZs1i71J/DTVwsVIVf8McQfuXBxjiZtU7ghy3WrL5chvvfFo1S zKYqL+fxiCuSUoTZFWucJdnDmTfwyFmmfIRaVheCl5xn1z7Qdg/cEf0V99Qa4ETh gZ54gnX/T+whYn2nslRg96uPdYpT5ZtJwCOfsebriuQZRk8YFUP7RN7XbcvrxmA8 gO7jMmwknNM17l1GR41X4661vyBdfb1Kly7SRLAA== ARC-Authentication-Results: i=1; mx1.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=kernel.org header.i=@kernel.org header.b=pUrJWiKO x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=default; dmarc=none (p=none,has-list-id=yes,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-cm=none score=0; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes; x-vs=clean score=-100 state=0 Authentication-Results: mx1.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=kernel.org header.i=@kernel.org header.b=pUrJWiKO x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=default; dmarc=none (p=none,has-list-id=yes,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-cm=none score=0; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes; x-vs=clean score=-100 state=0 X-ME-VSCategory: clean X-CM-Envelope: MS4wfEJ4s7ENL9lh6PTc9LcFDsPzY7eG/flBz68YoCRXP2zFokd56/6d0P1Kkvpsp9w+ZjpYyrqjOk9Ie3SuOINiWqc3NAuaXgq0+NQkT8ps7JrqWjmU7Ob7 KBSd5i52I7nQZmL1Fy18eg3YErLbiXV4qIEWLP9ih5/oZo+H9Il85Mh0XHRvv22r8wCH8AM6tq+j9KD0UMm9saFwFmCi57bo8SlnMx3Qjlf+BI6/K+PFjbTu X-CM-Analysis: v=2.3 cv=WaUilXpX c=1 sm=1 tr=0 a=UK1r566ZdBxH71SXbqIOeA==:117 a=UK1r566ZdBxH71SXbqIOeA==:17 a=IkcTkHD0fZMA:10 a=VUJBJC2UJ8kA:10 a=VwQbUJbxAAAA:8 a=ag1SF4gXAAAA:8 a=7J7wI5G0n_s90aWr2ecA:9 a=AXru9cZfrOLLYJ90:21 a=oarUXJnYZj5-zp8d:21 a=QEXdDO2ut3YA:10 a=AjGcO6oz07-iQ99wixmX:22 a=Yupwre4RP9_Eg_Bd0iYG:22 X-ME-CMScore: 0 X-ME-CMCategory: none Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S969830AbeEXMR5 (ORCPT ); Thu, 24 May 2018 08:17:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:53564 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966040AbeEXJlp (ORCPT ); Thu, 24 May 2018 05:41:45 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wenwen Wang , Takashi Iwai Subject: [PATCH 3.18 30/45] ALSA: control: fix a redundant-copy issue Date: Thu, 24 May 2018 11:38:38 +0200 Message-Id: <20180524093124.446378576@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180524093120.599252450@linuxfoundation.org> References: <20180524093120.599252450@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wenwen Wang commit 3f12888dfae2a48741c4caa9214885b3aaf350f9 upstream. In snd_ctl_elem_add_compat(), the fields of the struct 'data' need to be copied from the corresponding fields of the struct 'data32' in userspace. This is achieved by invoking copy_from_user() and get_user() functions. The problem here is that the 'type' field is copied twice. One is by copy_from_user() and one is by get_user(). Given that the 'type' field is not used between the two copies, the second copy is *completely* redundant and should be removed for better performance and cleanup. Also, these two copies can cause inconsistent data: as the struct 'data32' resides in userspace and a malicious userspace process can race to change the 'type' field between the two copies to cause inconsistent data. Depending on how the data is used in the future, such an inconsistency may cause potential security risks. For above reasons, we should take out the second copy. Signed-off-by: Wenwen Wang Cc: Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/control_compat.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -400,8 +400,7 @@ static int snd_ctl_elem_add_compat(struc if (copy_from_user(&data->id, &data32->id, sizeof(data->id)) || copy_from_user(&data->type, &data32->type, 3 * sizeof(u32))) goto error; - if (get_user(data->owner, &data32->owner) || - get_user(data->type, &data32->type)) + if (get_user(data->owner, &data32->owner)) goto error; switch (data->type) { case SNDRV_CTL_ELEM_TYPE_BOOLEAN: