| From foo@baz Fri Jan 4 20:27:35 CET 2019 |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Wed, 2 Jan 2019 09:20:27 -0800 |
| Subject: isdn: fix kernel-infoleak in capi_unlocked_ioctl |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit d63967e475ae10f286dbd35e189cb241e0b1f284 ] |
| |
| Since capi_ioctl() copies 64 bytes after calling |
| capi20_get_manufacturer() we need to ensure to not leak |
| information to user. |
| |
| BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 |
| CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| Call Trace: |
| __dump_stack lib/dump_stack.c:77 [inline] |
| dump_stack+0x173/0x1d0 lib/dump_stack.c:113 |
| kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 |
| kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704 |
| kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601 |
| _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 |
| capi_ioctl include/linux/uaccess.h:177 [inline] |
| capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939 |
| do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46 |
| ksys_ioctl fs/ioctl.c:713 [inline] |
| __do_sys_ioctl fs/ioctl.c:720 [inline] |
| __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718 |
| __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718 |
| do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 |
| entry_SYSCALL_64_after_hwframe+0x63/0xe7 |
| RIP: 0033:0x440019 |
| Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 |
| RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010 |
| RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019 |
| RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003 |
| RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 |
| R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0 |
| R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000 |
| |
| Local variable description: ----data.i@capi_unlocked_ioctl |
| Variable was created at: |
| capi_ioctl drivers/isdn/capi/capi.c:747 [inline] |
| capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939 |
| do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46 |
| |
| Bytes 12-63 of 64 are uninitialized |
| Memory access of size 64 starts at ffff88807ac5fce8 |
| Data copied to user address 0000000020000080 |
| |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Cc: Karsten Keil <isdn@linux-pingi.de> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/isdn/capi/kcapi.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/isdn/capi/kcapi.c |
| +++ b/drivers/isdn/capi/kcapi.c |
| @@ -851,7 +851,7 @@ u16 capi20_get_manufacturer(u32 contr, u |
| u16 ret; |
| |
| if (contr == 0) { |
| - strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN); |
| + strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN); |
| return CAPI_NOERROR; |
| } |
| |
| @@ -859,7 +859,7 @@ u16 capi20_get_manufacturer(u32 contr, u |
| |
| ctr = get_capi_ctr_by_nr(contr); |
| if (ctr && ctr->state == CAPI_CTR_RUNNING) { |
| - strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN); |
| + strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN); |
| ret = CAPI_NOERROR; |
| } else |
| ret = CAPI_REGNOTINSTALLED; |