Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751219AbdFCHfW (ORCPT ); Sat, 3 Jun 2017 03:35:22 -0400 Received: from tartarus.angband.pl ([89.206.35.136]:58420 "EHLO tartarus.angband.pl" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750991AbdFCHfU (ORCPT ); Sat, 3 Jun 2017 03:35:20 -0400 From: Adam Borowski To: Greg Kroah-Hartman , Jiri Slaby , linux-kernel@vger.kernel.org Cc: Adam Borowski , stable@vger.kernel.org, #@umbar.angband.pl, v3.7-@umbar.angband.pl Date: Sat, 3 Jun 2017 09:35:06 +0200 Message-Id: <20170603073509.4718-2-kilobyte@angband.pl> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170603073509.4718-1-kilobyte@angband.pl> References: <20170603073255.zgpfmdp2pqusz4qw@angband.pl> <20170603073509.4718-1-kilobyte@angband.pl> X-SA-Exim-Connect-IP: 89.71.161.30 X-SA-Exim-Mail-From: kilobyte@angband.pl Subject: [PATCH 2/5] vt: fix unchecked __put_user() in tioclinux ioctls X-SA-Exim-Version: 4.2.1 (built Tue, 02 Aug 2016 21:08:31 +0000) X-SA-Exim-Scanned: Yes (on tartarus.angband.pl) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1509 Lines: 47 Only read access is checked before this call. Actually, at the moment this is not an issue, as every in-tree arch does the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU to tell them apart, but this wasn't the case in the past and may happen again on some odd arch in the future. If anyone cares about 3.7 and earlier, this is a security hole (untested) on real 80386 CPUs. Signed-off-by: Adam Borowski CC: stable@vger.kernel.org # v3.7- --- drivers/tty/vt/vt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 9309c7da660a..2ebaba16f785 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -2709,13 +2709,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) * related to the kernel should not use this. */ data = vt_get_shift_state(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_GETMOUSEREPORTING: console_lock(); /* May be overkill */ data = mouse_reporting(); console_unlock(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETVESABLANK: console_lock(); @@ -2724,7 +2724,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) break; case TIOCL_GETKMSGREDIRECT: data = vt_get_kmsg_redirect(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETKMSGREDIRECT: if (!capable(CAP_SYS_ADMIN)) { -- 2.11.0