lkml.org 
[lkml]   [2022]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 33/35] macintosh/adb: fix oob read in do_adb_query() function
    Date
    From: Ning Qiang <sohu0106@126.com>

    commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream.

    In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied
    form userland. The parameter "req->data[2]" is missing check, the array
    size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and
    adb_handler[req->data[2]].handler_id will lead to oob read.

    Cc: stable <stable@kernel.org>
    Signed-off-by: Ning Qiang <sohu0106@126.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/macintosh/adb.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/macintosh/adb.c
    +++ b/drivers/macintosh/adb.c
    @@ -647,7 +647,7 @@ do_adb_query(struct adb_request *req)

    switch(req->data[1]) {
    case ADB_QUERY_GETDEVINFO:
    - if (req->nbytes < 3)
    + if (req->nbytes < 3 || req->data[2] >= 16)
    break;
    mutex_lock(&adb_handler_mutex);
    req->reply[0] = adb_handler[req->data[2]].original_address;

    \
     
     \ /
      Last update: 2022-08-09 20:30    [W:3.042 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site