From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932110AbbFASov (ORCPT ); Mon, 1 Jun 2015 14:44:51 -0400 Received: from mout.gmx.net ([212.227.17.20]:53851 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750812AbbFASom (ORCPT ); Mon, 1 Jun 2015 14:44:42 -0400 Date: Mon, 1 Jun 2015 20:44:37 +0200 From: Helge Deller To: Al Viro , Linus Torvalds , linux-kernel@vger.kernel.org Subject: [PATCH] compat: fix possible out-of-bound accesses in compat_get_bitmap() and compat_put_bitmap() Message-ID: <20150601184437.GA2534@ls3530.box> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Provags-ID: V03:K0:QsBJJXmtmqi/+LgZ0rChmBCUe7ioBvYgVDESW8m51O962Mvzj+t xoXse7LZrq79pvcHPLPjg9O1i87MgME/D7IsxI/IfUjMQW0zZ00UYSCamKK4ntWbCd+4IMi aolpm/PfraJJtiV5SL80572/RkCi9ExQKvP7vboydgJDzv+1ssPxa+1rtm4/Br+FrjyAM+2 rObkVeNKS7GiTrtygtX3Q== X-UI-Out-Filterresults: notjunk:1; Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In functions compat_get_bitmap() and compat_put_bitmap() the variable nr_compat_longs stores how many compat_ulong_t words should be copied in a loop. The copy-loop itself is this: if (nr_compat_longs-- > 0) { if (__get_user(um, umask)) return -EFAULT; } else { um = 0; } Since nr_compat_longs gets unconditionally decremented in each loop, it's type needs to be signed instead of unsigned to avoid possibly accessing userspace memory behind the bitmap which shouldn't be accessed. This bug seems to have been here for quite some time already, e.g. kernel 2.6.11 has the same coding. I didn't checked earlier versions. Signed-off-by: Helge Deller To: Al Viro Cc: stable@vger.kernel.org diff --git a/kernel/compat.c b/kernel/compat.c index 24f0061..bfbb312 100644 --- a/kernel/compat.c +++ b/kernel/compat.c @@ -893,7 +893,7 @@ long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask, int i, j; unsigned long m; compat_ulong_t um; - unsigned long nr_compat_longs; + signed long nr_compat_longs; /* align bitmap up to nearest compat_long_t boundary */ bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG); @@ -934,7 +934,7 @@ long compat_put_bitmap(compat_ulong_t __user *umask, unsigned long *mask, int i, j; unsigned long m; compat_ulong_t um; - unsigned long nr_compat_longs; + signed long nr_compat_longs; /* align bitmap up to nearest compat_long_t boundary */ bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG);