From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09E79C43215 for ; Wed, 27 Nov 2019 21:44:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C401920869 for ; Wed, 27 Nov 2019 21:44:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574891069; bh=lZr7US6FaeThTI/d26sQnxKvcAV50nPIC10UNTCyzG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RLRRt2fFxehoaijjnqK9o+sT5Q6uGi5YbXpV4diIrpcC41uMEFH1OfRY1xfNfmeRw tfyAYX1uUKboYZyw2uADu69sXAt/p50nifdT5MNjXdrm7GOw+TIgv5iGURvJnNiXTw AgfBCi5gElwpLz1qVyTqX8vwvd1w071dBIiAhXbk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727617AbfK0UhZ (ORCPT ); Wed, 27 Nov 2019 15:37:25 -0500 Received: from mail.kernel.org ([198.145.29.99]:40368 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728569AbfK0UhY (ORCPT ); Wed, 27 Nov 2019 15:37:24 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3B411215B2; Wed, 27 Nov 2019 20:37:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574887043; bh=lZr7US6FaeThTI/d26sQnxKvcAV50nPIC10UNTCyzG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BKp0+2KG7tmauv3m1yAlW+4XrSJ4I7np6BUuQa6o50yuQFQ7ZOHdsIoXEkUulS7IN OHs7mxIewWa0S45ZW4aoyPzlZyjlMmF/7NziDT5TVfAS3n1H+05Q1gtzvBPoQBMkAn OacV9nxuFq1ewgNXJwutGEDsTfUqEyhwQYQ5Nl4w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tycho Andersen , David Teigland , Sasha Levin Subject: [PATCH 4.4 091/132] dlm: dont leak kernel pointer to userspace Date: Wed, 27 Nov 2019 21:31:22 +0100 Message-Id: <20191127203019.010365205@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191127202857.270233486@linuxfoundation.org> References: <20191127202857.270233486@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tycho Andersen [ Upstream commit 9de30f3f7f4d31037cfbb7c787e1089c1944b3a7 ] In copy_result_to_user(), we first create a struct dlm_lock_result, which contains a struct dlm_lksb, the last member of which is a pointer to the lvb. Unfortunately, we copy the entire struct dlm_lksb to the result struct, which is then copied to userspace at the end of the function, leaking the contents of sb_lvbptr, which is a valid kernel pointer in some cases (indeed, later in the same function the data it points to is copied to userspace). It is an error to leak kernel pointers to userspace, as it undermines KASLR protections (see e.g. 65eea8edc31 ("floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl") for another example of this). Signed-off-by: Tycho Andersen Signed-off-by: David Teigland Signed-off-by: Sasha Levin --- fs/dlm/user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dlm/user.c b/fs/dlm/user.c index e40c440a45552..dd2b7416e40ae 100644 --- a/fs/dlm/user.c +++ b/fs/dlm/user.c @@ -705,7 +705,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat, result.version[0] = DLM_DEVICE_VERSION_MAJOR; result.version[1] = DLM_DEVICE_VERSION_MINOR; result.version[2] = DLM_DEVICE_VERSION_PATCH; - memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb)); + memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr)); result.user_lksb = ua->user_lksb; /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated -- 2.20.1