lkml.org 
[lkml]   [2020]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.14 013/108] Smack: slab-out-of-bounds in vsscanf
    Date
    From: Casey Schaufler <casey@schaufler-ca.com>

    [ Upstream commit 84e99e58e8d1e26f04c097f4266e431a33987f36 ]

    Add barrier to soob. Return -EOVERFLOW if the buffer
    is exceeded.

    Suggested-by: Hillf Danton <hdanton@sina.com>
    Reported-by: syzbot+bfdd4a2f07be52351350@syzkaller.appspotmail.com
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/smack/smackfs.c | 10 ++++++++++
    1 file changed, 10 insertions(+)

    diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
    index f6482e53d55a..371ae368da35 100644
    --- a/security/smack/smackfs.c
    +++ b/security/smack/smackfs.c
    @@ -906,11 +906,21 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
    else
    rule += strlen(skp->smk_known) + 1;

    + if (rule > data + count) {
    + rc = -EOVERFLOW;
    + goto out;
    + }
    +
    ret = sscanf(rule, "%d", &maplevel);
    if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
    goto out;

    rule += SMK_DIGITLEN;
    + if (rule > data + count) {
    + rc = -EOVERFLOW;
    + goto out;
    + }
    +
    ret = sscanf(rule, "%d", &catlen);
    if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
    goto out;
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-18 03:54    [W:4.438 / U:0.528 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site