From patchwork Tue May 6 19:10:32 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 346297 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 0BD2D1402A2; Wed, 7 May 2014 05:10:56 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1WhklQ-0004DX-RE; Tue, 06 May 2014 19:10:52 +0000 Received: from mail-qc0-f173.google.com ([209.85.216.173]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1WhklI-0004CY-D0 for kernel-team@lists.ubuntu.com; Tue, 06 May 2014 19:10:44 +0000 Received: by mail-qc0-f173.google.com with SMTP id i8so3940656qcq.18 for ; Tue, 06 May 2014 12:10:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=IqGtA2nULzFoCSCKDc1I9gXGiGjndY8tNdxLoJGH/0k=; b=L8gLuUjxeIin6fqL6Av5OzsdA0CD5HsRlZ9KAmnCFQKePcvszgLaxWgvrFHPZga6mt jast1XG8tn5vlxdF5BUw8yTkN7lqg5U3OTOR42ET3XuzPJ8Hb6GQ7r0J2y774hh243Nc MynmYraDeHhEfLT+ZlRrD38Gq4NO78Gu+LDBrqa4RzgCrLhMHZ57nfM0ag0fWS1RUalO Ggcz+SLjhW6cgISPuYJ/pGqDjuRsK4+1wHeo22BrwbaScmEhWW3uLZmc/4hyyKq9sUpa B3Mr/07gFGxNpVQk6RGEYnyi7wZqSXFXzTMLReV6MfCWwKkHVB8XJ+a16d25Igtw0CbX gpxA== X-Gm-Message-State: ALoCoQk+Rv/0g2N/mvFezOpEPkMWSK0tKj0YAxrxmhCf9xKQNWzCK6tRS/CmWqPeE0SdCHMPYVVO X-Received: by 10.224.51.2 with SMTP id b2mr58227735qag.49.1399403443677; Tue, 06 May 2014 12:10:43 -0700 (PDT) Received: from localhost ([2001:470:6973:2:221:70ff:fe81:b177]) by mx.google.com with ESMTPSA id l61sm16789045qge.11.2014.05.06.12.10.42 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Tue, 06 May 2014 12:10:43 -0700 (PDT) From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [lucid 1/2] floppy: ignore kernel-only members in FDRAWCMD ioctl input Date: Tue, 6 May 2014 20:10:32 +0100 Message-Id: <1399403436-21214-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1399403436-21214-1-git-send-email-apw@canonical.com> References: <1399403436-21214-1-git-send-email-apw@canonical.com> Cc: Andy Whitcroft X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Matthew Daley Always clear out these floppy_raw_cmd struct members after copying the entire structure from userspace so that the in-kernel version is always valid and never left in an interdeterminate state. Signed-off-by: Matthew Daley Signed-off-by: Linus Torvalds (backported from commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream) CVE-2014-1737 BugLink: http://bugs.launchpad.net/bugs/1316729 Signed-off-by: Andy Whitcroft --- drivers/block/floppy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 5c01f74..e0022b1 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3209,9 +3209,12 @@ static inline int raw_cmd_copyin(int cmd, char __user *param, if (!ptr) return -ENOMEM; *rcmd = ptr; - COPYIN(*ptr); + ret = _COPYIN(*ptr); ptr->next = NULL; ptr->buffer_length = 0; + ptr->kernel_data = NULL; + if (ret) + return ret; param += sizeof(struct floppy_raw_cmd); if (ptr->cmd_count > 33) /* the command may now also take up the space @@ -3227,7 +3230,6 @@ static inline int raw_cmd_copyin(int cmd, char __user *param, for (i = 0; i < 16; i++) ptr->reply[i] = 0; ptr->resultcode = 0; - ptr->kernel_data = NULL; if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { if (ptr->length <= 0)