Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932185Ab0DFWAX (ORCPT ); Tue, 6 Apr 2010 18:00:23 -0400 Received: from einhorn.in-berlin.de ([192.109.42.8]:49156 "EHLO einhorn.in-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757519Ab0DFWAB (ORCPT ); Tue, 6 Apr 2010 18:00:01 -0400 X-Envelope-From: stefanr@s5r6.in-berlin.de Date: Tue, 6 Apr 2010 23:59:45 +0200 (CEST) From: Stefan Richter Subject: [PATCH] firewire: cdev: fix information leak To: linux1394-devel@lists.sourceforge.net cc: Clemens Ladisch , linux-kernel@vger.kernel.org In-Reply-To: Message-ID: References: <4BBAD1BC.2070100@ladisch.de> <4BBADAA1.9050508@s5r6.in-berlin.de> <4BBAF7EE.5000804@ladisch.de> <4BBB8851.6000509@s5r6.in-berlin.de> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=us-ascii Content-Disposition: INLINE Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2810 Lines: 88 A userspace client got to see uninitialized stack-allocated memory if it specified an _IOC_READ type of ioctl and an argument size larger than expected by firewire-core's ioctl handlers (but not larger than the core's union ioctl_arg). Fix this by clearing the requested buffer size to zero, but only at _IOR ioctls. This way, there is almost no runtime penalty to legit ioctls. The only legit _IOR is FW_CDEV_IOC_GET_CYCLE_TIMER with 12...16 bytes to memset. [Another way to fix this would be strict checking of argument size (and possibly direction) vs. command number. However, we then need a lookup table, and we need to allow for slight size deviations in case of 32bit userland on 64bit kernel.] Reported-by: Clemens Ladisch Signed-off-by: Stefan Richter --- drivers/firewire/core-cdev.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) Index: b/drivers/firewire/core-cdev.c =================================================================== --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -1346,41 +1346,43 @@ static int (* const ioctl_handlers[])(st static int dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg) { union ioctl_arg buffer; int ret; if (fw_device_is_shutdown(client->device)) return -ENODEV; if (_IOC_TYPE(cmd) != '#' || _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers)) return -EINVAL; - if (_IOC_DIR(cmd) & _IOC_WRITE) { - if (_IOC_SIZE(cmd) > sizeof(buffer) || - copy_from_user(&buffer, arg, _IOC_SIZE(cmd))) + if (_IOC_SIZE(cmd) > sizeof(buffer)) + return -EFAULT; + + if (_IOC_DIR(cmd) == _IOC_READ) + memset(&buffer, 0, _IOC_SIZE(cmd)); + + if (_IOC_DIR(cmd) & _IOC_WRITE) + if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd))) return -EFAULT; - } ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer); if (ret < 0) return ret; - if (_IOC_DIR(cmd) & _IOC_READ) { - if (_IOC_SIZE(cmd) > sizeof(buffer) || - copy_to_user(arg, &buffer, _IOC_SIZE(cmd))) + if (_IOC_DIR(cmd) & _IOC_READ) + if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd))) return -EFAULT; - } return ret; } static long fw_device_op_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { return dispatch_ioctl(file->private_data, cmd, (void __user *)arg); } #ifdef CONFIG_COMPAT static long fw_device_op_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -- Stefan Richter -=====-==-=- -=-- --==- http://arcgraph.de/sr/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/