lkml.org 
[lkml]   [2019]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 11/47] isdn: fix kernel-infoleak in capi_unlocked_ioctl
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit d63967e475ae10f286dbd35e189cb241e0b1f284 ]

    Since capi_ioctl() copies 64 bytes after calling
    capi20_get_manufacturer() we need to ensure to not leak
    information to user.

    BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x173/0x1d0 lib/dump_stack.c:113
    kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
    kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704
    kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
    _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    capi_ioctl include/linux/uaccess.h:177 [inline]
    capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939
    do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
    ksys_ioctl fs/ioctl.c:713 [inline]
    __do_sys_ioctl fs/ioctl.c:720 [inline]
    __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
    __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
    do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
    entry_SYSCALL_64_after_hwframe+0x63/0xe7
    RIP: 0033:0x440019
    Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019
    RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003
    RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
    R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0
    R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000

    Local variable description: ----data.i@capi_unlocked_ioctl
    Variable was created at:
    capi_ioctl drivers/isdn/capi/capi.c:747 [inline]
    capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939
    do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46

    Bytes 12-63 of 64 are uninitialized
    Memory access of size 64 starts at ffff88807ac5fce8
    Data copied to user address 0000000020000080

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Cc: Karsten Keil <isdn@linux-pingi.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/isdn/capi/kcapi.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/isdn/capi/kcapi.c
    +++ b/drivers/isdn/capi/kcapi.c
    @@ -851,7 +851,7 @@ u16 capi20_get_manufacturer(u32 contr, u
    u16 ret;

    if (contr == 0) {
    - strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
    + strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
    return CAPI_NOERROR;
    }

    @@ -859,7 +859,7 @@ u16 capi20_get_manufacturer(u32 contr, u

    ctr = get_capi_ctr_by_nr(contr);
    if (ctr && ctr->state == CAPI_CTR_RUNNING) {
    - strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
    + strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
    ret = CAPI_NOERROR;
    } else
    ret = CAPI_REGNOTINSTALLED;

    \
     
     \ /
      Last update: 2019-01-11 16:11    [W:4.140 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site