| From e33eeb880ae5b10c46e8de502e0fb4390b8f0a02 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 2 Nov 2018 14:18:22 -0600 |
| Subject: dlm: don't leak kernel pointer to userspace |
| |
| From: Tycho Andersen <tycho@tycho.ws> |
| |
| [ Upstream commit 9de30f3f7f4d31037cfbb7c787e1089c1944b3a7 ] |
| |
| In copy_result_to_user(), we first create a struct dlm_lock_result, which |
| contains a struct dlm_lksb, the last member of which is a pointer to the |
| lvb. Unfortunately, we copy the entire struct dlm_lksb to the result |
| struct, which is then copied to userspace at the end of the function, |
| leaking the contents of sb_lvbptr, which is a valid kernel pointer in some |
| cases (indeed, later in the same function the data it points to is copied |
| to userspace). |
| |
| It is an error to leak kernel pointers to userspace, as it undermines KASLR |
| protections (see e.g. 65eea8edc31 ("floppy: Do not copy a kernel pointer to |
| user memory in FDGETPRM ioctl") for another example of this). |
| |
| Signed-off-by: Tycho Andersen <tycho@tycho.ws> |
| Signed-off-by: David Teigland <teigland@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/dlm/user.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/fs/dlm/user.c b/fs/dlm/user.c |
| index 2a669390cd7f6..13f29409600bb 100644 |
| --- a/fs/dlm/user.c |
| +++ b/fs/dlm/user.c |
| @@ -702,7 +702,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat, |
| result.version[0] = DLM_DEVICE_VERSION_MAJOR; |
| result.version[1] = DLM_DEVICE_VERSION_MINOR; |
| result.version[2] = DLM_DEVICE_VERSION_PATCH; |
| - memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb)); |
| + memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr)); |
| result.user_lksb = ua->user_lksb; |
| |
| /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated |
| -- |
| 2.20.1 |
| |
