| From a1f74ae82d133ebb2aabb19d181944b4e83e9960 Mon Sep 17 00:00:00 2001 |
| From: Dan Rosenberg <drosenberg@vsecurity.com> |
| Date: Tue, 5 Apr 2011 12:45:59 -0400 |
| Subject: [SCSI] mpt2sas: prevent heap overflows and unchecked reads |
| |
| From: Dan Rosenberg <drosenberg@vsecurity.com> |
| |
| commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream. |
| |
| At two points in handling device ioctls via /dev/mpt2ctl, user-supplied |
| length values are used to copy data from userspace into heap buffers |
| without bounds checking, allowing controllable heap corruption and |
| subsequently privilege escalation. |
| |
| Additionally, user-supplied values are used to determine the size of a |
| copy_to_user() as well as the offset into the buffer to be read, with no |
| bounds checking, allowing users to read arbitrary kernel memory. |
| |
| Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> |
| Acked-by: Eric Moore <eric.moore@lsi.com> |
| Signed-off-by: James Bottomley <James.Bottomley@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/scsi/mpt2sas/mpt2sas_ctl.c | 23 +++++++++++++++++++++-- |
| 1 file changed, 21 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c |
| +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c |
| @@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT |
| data_out_sz = karg.data_out_size; |
| data_in_sz = karg.data_in_size; |
| |
| + /* Check for overflow and wraparound */ |
| + if (karg.data_sge_offset * 4 > ioc->request_sz || |
| + karg.data_sge_offset > (UINT_MAX / 4)) { |
| + ret = -EINVAL; |
| + goto out; |
| + } |
| + |
| /* copy in request message frame from user */ |
| if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) { |
| printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__, |
| @@ -1876,7 +1883,7 @@ _ctl_diag_read_buffer(void __user *arg, |
| Mpi2DiagBufferPostReply_t *mpi_reply; |
| int rc, i; |
| u8 buffer_type; |
| - unsigned long timeleft; |
| + unsigned long timeleft, request_size, copy_size; |
| u16 smid; |
| u16 ioc_status; |
| u8 issue_reset = 0; |
| @@ -1912,6 +1919,8 @@ _ctl_diag_read_buffer(void __user *arg, |
| return -ENOMEM; |
| } |
| |
| + request_size = ioc->diag_buffer_sz[buffer_type]; |
| + |
| if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) { |
| printk(MPT2SAS_ERR_FMT "%s: either the starting_offset " |
| "or bytes_to_read are not 4 byte aligned\n", ioc->name, |
| @@ -1919,13 +1928,23 @@ _ctl_diag_read_buffer(void __user *arg, |
| return -EINVAL; |
| } |
| |
| + if (karg.starting_offset > request_size) |
| + return -EINVAL; |
| + |
| diag_data = (void *)(request_data + karg.starting_offset); |
| dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), " |
| "offset(%d), sz(%d)\n", ioc->name, __func__, |
| diag_data, karg.starting_offset, karg.bytes_to_read)); |
| |
| + /* Truncate data on requests that are too large */ |
| + if ((diag_data + karg.bytes_to_read < diag_data) || |
| + (diag_data + karg.bytes_to_read > request_data + request_size)) |
| + copy_size = request_size - karg.starting_offset; |
| + else |
| + copy_size = karg.bytes_to_read; |
| + |
| if (copy_to_user((void __user *)uarg->diagnostic_data, |
| - diag_data, karg.bytes_to_read)) { |
| + diag_data, copy_size)) { |
| printk(MPT2SAS_ERR_FMT "%s: Unable to write " |
| "mpt_diag_read_buffer_t data @ %p\n", ioc->name, |
| __func__, diag_data); |