* [PATCH] misc: fastrpc: restrict user apps from sending kernel RPC messages
@ 2021-02-11 23:37 Dmitry Baryshkov
2021-02-11 23:40 ` Randy Dunlap
0 siblings, 1 reply; 2+ messages in thread
From: Dmitry Baryshkov @ 2021-02-11 23:37 UTC (permalink / raw)
To: Arnd Bergmann, Greg Kroah-Hartman
Cc: linux-kernel, Srinivas Kandagatla, Jonathan Marek, stable
Verify that user applications are not using the kernel RPC message
handle to restrict them from directly attaching to guest OS on the
remote subsystem. This is a port of CVE-2019-2308 fix.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Jonathan Marek <jonathan@marek.ca>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
---
drivers/misc/fastrpc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 815d01f785df..e7f3a22fdaa3 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -948,6 +948,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
if (!fl->cctx->rpdev)
return -EPIPE;
+ if (handle == FASTRPC_INIT_HANDLE && !kernel) {
+ dev_warn(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle);
+ return -EPERM;
+ }
+
ctx = fastrpc_context_alloc(fl, kernel, sc, args);
if (IS_ERR(ctx))
return PTR_ERR(ctx);
--
2.30.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] misc: fastrpc: restrict user apps from sending kernel RPC messages
2021-02-11 23:37 [PATCH] misc: fastrpc: restrict user apps from sending kernel RPC messages Dmitry Baryshkov
@ 2021-02-11 23:40 ` Randy Dunlap
0 siblings, 0 replies; 2+ messages in thread
From: Randy Dunlap @ 2021-02-11 23:40 UTC (permalink / raw)
To: Dmitry Baryshkov, Arnd Bergmann, Greg Kroah-Hartman
Cc: linux-kernel, Srinivas Kandagatla, Jonathan Marek, stable
On 2/11/21 3:37 PM, Dmitry Baryshkov wrote:
> Verify that user applications are not using the kernel RPC message
> handle to restrict them from directly attaching to guest OS on the
> remote subsystem. This is a port of CVE-2019-2308 fix.
>
> Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
> Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> Cc: Jonathan Marek <jonathan@marek.ca>
> Cc: stable@vger.kernel.org
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> ---
> drivers/misc/fastrpc.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 815d01f785df..e7f3a22fdaa3 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -948,6 +948,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
> if (!fl->cctx->rpdev)
> return -EPIPE;
>
> + if (handle == FASTRPC_INIT_HANDLE && !kernel) {
> + dev_warn(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle);
rate limit so that userspace cannot flood kernel log?
> + return -EPERM;
> + }
> +
> ctx = fastrpc_context_alloc(fl, kernel, sc, args);
> if (IS_ERR(ctx))
> return PTR_ERR(ctx);
>
--
~Randy
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-02-11 23:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-11 23:37 [PATCH] misc: fastrpc: restrict user apps from sending kernel RPC messages Dmitry Baryshkov
2021-02-11 23:40 ` Randy Dunlap
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).