lkml.org 
[lkml]   [2018]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 054/141] scsi: megaraid_sas: fix a missing-check bug
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wenwen Wang <wang6495@umn.edu>

    [ Upstream commit 47db7873136a9c57c45390a53b57019cf73c8259 ]

    In megasas_mgmt_compat_ioctl_fw(), to handle the structure
    compat_megasas_iocpacket 'cioc', a user-space structure megasas_iocpacket
    'ioc' is allocated before megasas_mgmt_ioctl_fw() is invoked to handle
    the packet. Since the two data structures have different fields, the data
    is copied from 'cioc' to 'ioc' field by field. In the copy process,
    'sense_ptr' is prepared if the field 'sense_len' is not null, because it
    will be used in megasas_mgmt_ioctl_fw(). To prepare 'sense_ptr', the
    user-space data 'ioc->sense_off' and 'cioc->sense_off' are copied and
    saved to kernel-space variables 'local_sense_off' and 'user_sense_off'
    respectively. Given that 'ioc->sense_off' is also copied from
    'cioc->sense_off', 'local_sense_off' and 'user_sense_off' should have the
    same value. However, 'cioc' is in the user space and a malicious user can
    race to change the value of 'cioc->sense_off' after it is copied to
    'ioc->sense_off' but before it is copied to 'user_sense_off'. By doing
    so, the attacker can inject different values into 'local_sense_off' and
    'user_sense_off'. This can cause undefined behavior in the following
    execution, because the two variables are supposed to be same.

    This patch enforces a check on the two kernel variables 'local_sense_off'
    and 'user_sense_off' to make sure they are the same after the copy. In
    case they are not, an error code EINVAL will be returned.

    Signed-off-by: Wenwen Wang <wang6495@umn.edu>
    Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/scsi/megaraid/megaraid_sas_base.c
    +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
    @@ -6901,6 +6901,9 @@ static int megasas_mgmt_compat_ioctl_fw(
    get_user(user_sense_off, &cioc->sense_off))
    return -EFAULT;

    + if (local_sense_off != user_sense_off)
    + return -EINVAL;
    +
    if (local_sense_len) {
    void __user **sense_ioc_ptr =
    (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);

    \
     
     \ /
      Last update: 2018-11-11 23:44    [W:2.080 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site