| 1 |
From df8157dcc213cb18f9b1c02891c8db457b0160d0 Mon Sep 17 00:00:00 2001 |
| 2 |
From: Wenwen Wang <wang6495@umn.edu> |
| 3 |
Date: Sat, 6 Oct 2018 13:34:21 -0500 |
| 4 |
Subject: [PATCH 095/145] scsi: megaraid_sas: fix a missing-check bug |
| 5 |
|
| 6 |
[ Upstream commit 47db7873136a9c57c45390a53b57019cf73c8259 ] |
| 7 |
|
| 8 |
In megasas_mgmt_compat_ioctl_fw(), to handle the structure |
| 9 |
compat_megasas_iocpacket 'cioc', a user-space structure megasas_iocpacket |
| 10 |
'ioc' is allocated before megasas_mgmt_ioctl_fw() is invoked to handle |
| 11 |
the packet. Since the two data structures have different fields, the data |
| 12 |
is copied from 'cioc' to 'ioc' field by field. In the copy process, |
| 13 |
'sense_ptr' is prepared if the field 'sense_len' is not null, because it |
| 14 |
will be used in megasas_mgmt_ioctl_fw(). To prepare 'sense_ptr', the |
| 15 |
user-space data 'ioc->sense_off' and 'cioc->sense_off' are copied and |
| 16 |
saved to kernel-space variables 'local_sense_off' and 'user_sense_off' |
| 17 |
respectively. Given that 'ioc->sense_off' is also copied from |
| 18 |
'cioc->sense_off', 'local_sense_off' and 'user_sense_off' should have the |
| 19 |
same value. However, 'cioc' is in the user space and a malicious user can |
| 20 |
race to change the value of 'cioc->sense_off' after it is copied to |
| 21 |
'ioc->sense_off' but before it is copied to 'user_sense_off'. By doing |
| 22 |
so, the attacker can inject different values into 'local_sense_off' and |
| 23 |
'user_sense_off'. This can cause undefined behavior in the following |
| 24 |
execution, because the two variables are supposed to be same. |
| 25 |
|
| 26 |
This patch enforces a check on the two kernel variables 'local_sense_off' |
| 27 |
and 'user_sense_off' to make sure they are the same after the copy. In |
| 28 |
case they are not, an error code EINVAL will be returned. |
| 29 |
|
| 30 |
Signed-off-by: Wenwen Wang <wang6495@umn.edu> |
| 31 |
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com> |
| 32 |
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
| 33 |
Signed-off-by: Sasha Levin <sashal@kernel.org> |
| 34 |
--- |
| 35 |
drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++ |
| 36 |
1 file changed, 3 insertions(+) |
| 37 |
|
| 38 |
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c |
| 39 |
index 9aa9590c5373..f6de7526ded5 100644 |
| 40 |
--- a/drivers/scsi/megaraid/megaraid_sas_base.c |
| 41 |
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c |
| 42 |
@@ -7523,6 +7523,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) |
| 43 |
get_user(user_sense_off, &cioc->sense_off)) |
| 44 |
return -EFAULT; |
| 45 |
|
| 46 |
+ if (local_sense_off != user_sense_off) |
| 47 |
+ return -EINVAL; |
| 48 |
+ |
| 49 |
if (local_sense_len) { |
| 50 |
void __user **sense_ioc_ptr = |
| 51 |
(void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off); |
| 52 |
-- |
| 53 |
2.19.1 |
| 54 |
|
Parent Directory
| 
Revision Log