Messages in this thread | | | From | Miquel Raynal <> | Subject | Re: [PATCH v2] mtdchar: prevent unbounded allocation in MEMWRITE ioctl | Date | Fri, 3 Dec 2021 14:37:20 +0100 |
| |
On Tue, 2021-11-30 at 11:31:49 UTC, =?utf-8?b?TWljaGHFgiBLxJlwaWXFhA==?= wrote: > In the mtdchar_write_ioctl() function, memdup_user() is called with its > 'len' parameter set to verbatim values provided by user space via a > struct mtd_write_req. Both the 'len' and 'ooblen' fields of that > structure are 64-bit unsigned integers, which means the MEMWRITE ioctl > can trigger unbounded kernel memory allocation requests. > > Fix by iterating over the buffers provided by user space in a loop, > processing at most mtd->erasesize bytes in each iteration. Adopt some > checks from mtd_check_oob_ops() to retain backward user space > compatibility. > > Suggested-by: Boris Brezillon <boris.brezillon@collabora.com> > Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Miquel
| |