From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Adrian Salido <salidoa@google.com>,
Alasdair G Kergon <agk@redhat.com>,
Mike Snitzer <snitzer@redhat.com>
Subject: [PATCH 4.9 9/9] dm ioctl: prevent stack leak in dm ioctl call
Date: Sat, 6 May 2017 13:39:30 -0700 [thread overview]
Message-ID: <20170506203835.294057976@linuxfoundation.org> (raw)
In-Reply-To: <20170506203834.910233209@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Salido <salidoa@google.com>
commit 4617f564c06117c7d1b611be49521a4430042287 upstream.
When calling a dm ioctl that doesn't process any data
(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct
dm_ioctl are left initialized. Current code is incorrectly extending
the size of data copied back to user, causing the contents of kernel
stack to be leaked to user. Fix by only copying contents before data
and allow the functions processing the ioctl to override.
Signed-off-by: Adrian Salido <salidoa@google.com>
Reviewed-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1847,7 +1847,7 @@ static int ctl_ioctl(uint command, struc
if (r)
goto out;
- param->data_size = sizeof(*param);
+ param->data_size = offsetof(struct dm_ioctl, data);
r = fn(param, input_param_size);
if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
next prev parent reply other threads:[~2017-05-06 20:41 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-06 20:39 [PATCH 4.9 0/9] 4.9.27-stable review Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 1/9] timerfd: Protect the might cancel mechanism proper Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 2/9] Handle mismatched open calls Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 3/9] tpm_tis: use default timeout value if chip reports it as zero Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 4/9] scsi: storvsc: Workaround for virtual DVD SCSI version Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 5/9] hwmon: (it87) Avoid registering the same chip on both SIO addresses Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 6/9] 8250_pci: Fix potential use-after-free in error path Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 7/9] ceph: try getting buffer capability for readahead/fadvise Greg Kroah-Hartman
2017-05-06 20:39 ` [PATCH 4.9 8/9] cpu/hotplug: Serialize callback invocations proper Greg Kroah-Hartman
2017-05-06 20:39 ` Greg Kroah-Hartman [this message]
2017-05-07 19:38 ` [PATCH 4.9 0/9] 4.9.27-stable review Guenter Roeck
2017-05-08 19:17 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170506203835.294057976@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=agk@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=salidoa@google.com \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox