lkml.org 
[lkml]   [2014]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 016/181] net/compat: Fix minor information leak in siocdevprivate_ioctl()
    Date
    From: Ben Hutchings <bhutchings@solarflare.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 417c3522b3202dacce4873cfb0190459fbce95c5 upstream.

    We don't need to check that ifr_data itself is a valid user pointer,
    but we should check &ifr_data is. Thankfully the copy of ifr_name is
    checked, so this can only leak a few bytes from immediately above the
    user address limit.

    Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    net/socket.c | 7 ++-----
    1 file changed, 2 insertions(+), 5 deletions(-)

    diff --git a/net/socket.c b/net/socket.c
    index dc57dae20a9a..c8ca896a9a5a 100644
    --- a/net/socket.c
    +++ b/net/socket.c
    @@ -3023,19 +3023,16 @@ static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
    if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
    IFNAMSIZ))
    return -EFAULT;
    - if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
    + if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
    return -EFAULT;
    data64 = compat_ptr(data32);

    u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));

    - /* Don't check these user accesses, just let that get trapped
    - * in the ioctl handler instead.
    - */
    if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
    IFNAMSIZ))
    return -EFAULT;
    - if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
    + if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
    return -EFAULT;

    return dev_ioctl(net, cmd, u_ifreq64);
    --
    2.0.0


    \
     
     \ /
      Last update: 2014-06-30 17:01    [W:5.727 / U:0.364 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site