From: Andi Kleen <andi@firstfloor.org>
To: drosenberg@vsecurity.com, stable@kernel.org, eric.moore@lsi.com,
James.Bottomley@suse.de, ak@linux.intel.com,
linux-kernel@vger.kernel.org, stable@kernel.org,
tim.bird@am.sony.com, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: [PATCH] [11/98] mpt2sas: prevent heap overflows and unchecked reads
Date: Tue, 26 Jul 2011 17:35:03 -0700 (PDT) [thread overview]
Message-ID: <20110727003503.2CC022403FF@tassilo.jf.intel.com> (raw)
In-Reply-To: <20110726534.972201586@firstfloor.org>
2.6.35-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Dan Rosenberg <drosenberg@vsecurity.com>
[ upstream commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 ]
At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
length values are used to copy data from userspace into heap buffers
without bounds checking, allowing controllable heap corruption and
subsequently privilege escalation.
Additionally, user-supplied values are used to determine the size of a
copy_to_user() as well as the offset into the buffer to be read, with no
bounds checking, allowing users to read arbitrary kernel memory.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Acked-by: Eric Moore <eric.moore@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Index: linux-2.6.35.y/drivers/scsi/mpt2sas/mpt2sas_ctl.c
===================================================================
--- linux-2.6.35.y.orig/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ linux-2.6.35.y/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -637,6 +637,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT
data_out_sz = karg.data_out_size;
data_in_sz = karg.data_in_size;
+ /* Check for overflow and wraparound */
+ if (karg.data_sge_offset * 4 > ioc->request_sz ||
+ karg.data_sge_offset > (UINT_MAX / 4)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
/* copy in request message frame from user */
if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1883,7 +1890,7 @@ _ctl_diag_read_buffer(void __user *arg,
Mpi2DiagBufferPostReply_t *mpi_reply;
int rc, i;
u8 buffer_type;
- unsigned long timeleft;
+ unsigned long timeleft, request_size, copy_size;
u16 smid;
u16 ioc_status;
u8 issue_reset = 0;
@@ -1919,6 +1926,8 @@ _ctl_diag_read_buffer(void __user *arg,
return -ENOMEM;
}
+ request_size = ioc->diag_buffer_sz[buffer_type];
+
if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
"or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -1926,13 +1935,23 @@ _ctl_diag_read_buffer(void __user *arg,
return -EINVAL;
}
+ if (karg.starting_offset > request_size)
+ return -EINVAL;
+
diag_data = (void *)(request_data + karg.starting_offset);
dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
"offset(%d), sz(%d)\n", ioc->name, __func__,
diag_data, karg.starting_offset, karg.bytes_to_read));
+ /* Truncate data on requests that are too large */
+ if ((diag_data + karg.bytes_to_read < diag_data) ||
+ (diag_data + karg.bytes_to_read > request_data + request_size))
+ copy_size = request_size - karg.starting_offset;
+ else
+ copy_size = karg.bytes_to_read;
+
if (copy_to_user((void __user *)uarg->diagnostic_data,
- diag_data, karg.bytes_to_read)) {
+ diag_data, copy_size)) {
printk(MPT2SAS_ERR_FMT "%s: Unable to write "
"mpt_diag_read_buffer_t data @ %p\n", ioc->name,
__func__, diag_data);
next prev parent reply other threads:[~2011-07-27 0:40 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-27 0:34 [PATCH] [0/98] 2.6.35.14 longterm review Andi Kleen
2011-07-27 0:34 ` [PATCH] [1/98] kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0 Andi Kleen
2011-07-27 0:34 ` [PATCH] [2/98] kbuild: Fix passing -Wno-* options to gcc 4.4+ Andi Kleen
2011-07-27 0:34 ` [PATCH] [3/98] Add Andi Kleen as 2.6.35 longterm maintainer Andi Kleen
2011-07-27 0:34 ` [PATCH] [4/98] Remove the old V4L1 v4lgrab.c file Andi Kleen
2011-07-27 0:34 ` [PATCH] [5/98] agp: fix arbitrary kernel memory writes Andi Kleen
2011-07-27 0:34 ` [PATCH] [6/98] agp: fix OOM and buffer overflow Andi Kleen
2011-07-27 0:34 ` [PATCH] [7/98] i8k: Tell gcc that *regs gets clobbered Andi Kleen
2011-07-27 0:35 ` [PATCH] [8/98] Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again) Andi Kleen
2011-07-27 0:35 ` [PATCH] [9/98] USB: serial/usb_wwan, fix tty NULL dereference Andi Kleen
2011-07-27 0:35 ` [PATCH] [10/98] ipv6: add special mode accept_ra=2 to accept RA while configured as router Andi Kleen
2011-07-27 17:41 ` Stephen Clark
2011-07-27 20:11 ` Andi Kleen
2011-07-27 0:35 ` Andi Kleen [this message]
2011-07-27 0:35 ` [PATCH] [12/98] slub: fix panic with DISCONTIGMEM Andi Kleen
2011-07-27 21:47 ` David Rientjes
2011-07-27 21:55 ` Andi Kleen
2011-07-27 0:35 ` [PATCH] [13/98] set memory ranges in N_NORMAL_MEMORY when onlined Andi Kleen
2011-07-27 0:35 ` [PATCH] [14/98] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci Andi Kleen
2011-07-27 0:35 ` [PATCH] [15/98] m68k/mm: Set all online nodes in N_NORMAL_MEMORY Andi Kleen
2011-07-27 0:35 ` [PATCH] [16/98] nfs: don't lose MS_SYNCHRONOUS on remount of noac mount Andi Kleen
2011-07-27 0:35 ` [PATCH] [17/98] NFSv4.1: Ensure state manager thread dies on last umount Andi Kleen
2011-07-27 0:35 ` [PATCH] [18/98] Input: xen-kbdfront - fix mouse getting stuck after save/restore Andi Kleen
2011-07-27 0:35 ` [PATCH] [19/98] pmcraid: reject negative request size Andi Kleen
2011-07-27 0:35 ` [PATCH] [20/98] put stricter guards on queue dead checks Andi Kleen
2011-07-27 0:35 ` [PATCH] [21/98] mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot() Andi Kleen
2011-07-27 0:35 ` [PATCH] [22/98] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish Andi Kleen
2011-07-27 0:35 ` [PATCH] [23/98] mmc: sdhci: Check mrq != NULL " Andi Kleen
2011-07-27 0:35 ` [PATCH] [24/98] USB: fix regression in usbip by setting has_tt flag Andi Kleen
2011-07-27 0:35 ` [PATCH] [25/98] x86, AMD: Fix APIC timer erratum 400 affecting K8 Rev.A-E processors Andi Kleen
2011-07-27 12:38 ` Boris Ostrovsky
2011-07-27 15:42 ` Andi Kleen
2011-07-27 16:06 ` Boris Ostrovsky
2011-07-27 20:13 ` Andi Kleen
2011-07-27 0:35 ` [PATCH] [26/98] af_unix: Only allow recv on connected seqpacket sockets Andi Kleen
2011-07-27 15:58 ` [stable] " Tim Gardner
2011-07-27 16:02 ` Andi Kleen
2011-07-27 19:23 ` Eric W. Biederman
2011-08-01 20:08 ` Andi Kleen
2011-08-01 20:43 ` Tim Gardner
2011-07-27 0:35 ` [PATCH] [27/98] ARM: 6891/1: prevent heap corruption in OABI semtimedop Andi Kleen
2011-07-27 0:35 ` [PATCH] [28/98] Open with O_CREAT flag set fails to open existing files on non writable directories Andi Kleen
2011-07-27 0:35 ` [PATCH] [29/98] can: Add missing socket check in can/bcm release Andi Kleen
2011-07-27 0:35 ` [PATCH] [30/98] fs/partitions/ldm.c: fix oops caused by corrupted partition table Andi Kleen
2011-07-27 0:35 ` [PATCH] [31/98] Input: elantech - discard the first 2 positions on some firmwares Andi Kleen
2011-07-27 0:35 ` [PATCH] [32/98] Staging: rtl8192su: Clean up in case of an error in module initialisation Andi Kleen
2011-07-27 0:35 ` [PATCH] [33/98] Staging: rtl8192su: Fix procfs code for interfaces not named wlan0 Andi Kleen
2011-07-27 0:35 ` [PATCH] [34/98] USB: teach "devices" file about Wireless and SuperSpeed USB Andi Kleen
2011-07-27 0:35 ` [PATCH] [35/98] SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494) Andi Kleen
2011-07-27 0:35 ` [PATCH] [36/98] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) Andi Kleen
2011-07-27 0:35 ` [PATCH] [37/98] nfs: fix compilation warning Andi Kleen
2011-07-27 0:35 ` [PATCH] [38/98] Fix corrupted OSF partition table parsing Andi Kleen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110727003503.2CC022403FF@tassilo.jf.intel.com \
--to=andi@firstfloor.org \
--cc=James.Bottomley@suse.de \
--cc=ak@linux.intel.com \
--cc=drosenberg@vsecurity.com \
--cc=eric.moore@lsi.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tim.bird@am.sony.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).