Mathieu Desnoyers 3ddc5b46a8
kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() ...
I found the following pattern that leads in to interesting findings:
grep -r "ret.*|=.*__put_user" *
grep -r "ret.*|=.*__get_user" *
grep -r "ret.*|=.*__copy" *
The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat,
since those appear in compat code, we could probably expect the kernel
addresses not to be reachable in the lower 32-bit range, so I think they
might not be exploitable.
For the "__get_user" cases, I don't think those are exploitable: the worse
that can happen is that the kernel will copy kernel memory into in-kernel
buffers, and will fail immediately afterward.
The alpha csum_partial_copy_from_user() seems to be missing the
access_ok() check entirely. The fix is inspired from x86. This could
lead to information leak on alpha. I also noticed that many architectures
map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I
wonder if the latter is performing the access checks on every
architectures.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com >
Cc: Richard Henderson <rth@twiddle.net >
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru >
Cc: Matt Turner <mattst88@gmail.com >
Cc: Jens Axboe <axboe@kernel.dk >
Cc: Oleg Nesterov <oleg@redhat.com >
Cc: David Miller <davem@davemloft.net >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2013-09-11 15:58:18 -07:00
2008-12-04 09:17:15 -08:00
2013-02-17 23:36:56 -05:00
2013-07-10 13:56:10 -07:00
2008-12-04 09:17:21 -08:00
2012-05-12 00:23:23 -07:00
2013-01-12 15:28:45 -08:00
2011-10-31 19:30:54 -04:00
2013-01-12 15:28:45 -08:00
2008-12-04 09:17:21 -08:00
2013-01-12 15:28:45 -08:00
2008-12-04 09:17:21 -08:00
2013-03-11 05:06:27 -07:00
2013-07-31 19:10:03 -07:00
2009-06-16 04:56:28 -07:00
2012-05-11 19:27:46 -07:00
2011-10-31 19:30:54 -04:00
2013-07-14 19:36:52 -04:00
2008-12-04 09:17:21 -08:00
2008-12-04 09:17:21 -08:00
2011-10-31 19:30:53 -04:00
2013-07-14 19:36:52 -04:00
2013-07-31 19:10:04 -07:00
2012-05-27 23:52:49 -07:00
2012-10-14 19:26:52 -04:00
2008-12-04 09:17:21 -08:00
2010-04-12 22:37:26 -07:00
2008-12-04 09:17:21 -08:00
2012-07-26 16:46:15 -07:00
2013-03-11 05:06:27 -07:00
2010-08-08 22:07:36 -07:00
2012-10-02 23:20:34 -04:00
2012-08-18 23:03:53 -07:00
2013-07-14 19:36:52 -04:00
2012-05-11 20:45:18 -07:00
2008-12-04 09:17:21 -08:00
2012-03-28 16:36:34 +02:00
2013-04-09 14:13:32 -04:00
2012-05-27 23:52:44 -07:00
2013-07-14 19:36:52 -04:00
2012-05-14 14:05:09 -07:00
2008-12-04 09:17:21 -08:00
2008-12-04 09:17:21 -08:00
2012-03-29 22:40:52 -07:00
2013-02-20 13:36:50 -08:00
2013-02-06 11:04:10 -08:00
2013-07-31 19:10:04 -07:00
2013-02-27 19:10:24 -08:00
2010-04-14 02:04:29 -07:00
2013-08-02 17:29:06 -07:00
2013-02-27 19:10:24 -08:00
2010-03-30 22:02:32 +09:00
2013-06-19 02:10:29 -07:00
2013-06-19 02:10:30 -07:00
2013-03-20 11:06:53 -07:00
2013-03-20 11:06:53 -07:00
2013-06-19 02:10:29 -07:00
2013-07-14 19:36:52 -04:00
2013-05-04 18:34:13 -07:00
2013-07-14 19:36:52 -04:00
2008-12-04 09:17:21 -08:00
2012-12-14 13:06:43 +10:30
2012-08-18 23:26:19 -07:00
2012-04-15 10:28:49 -07:00
2012-07-06 07:16:34 -05:00
2011-10-31 19:30:53 -04:00
2009-06-16 04:56:49 -07:00
2011-06-07 16:06:34 -07:00
2013-01-12 15:28:45 -08:00
2012-11-17 12:05:57 +00:00
2011-05-16 13:38:07 -07:00
2013-01-12 15:28:45 -08:00
2013-01-12 15:28:45 -08:00
2013-01-12 15:28:45 -08:00
2008-12-04 09:17:21 -08:00
2013-01-12 15:28:45 -08:00
2008-12-04 09:17:21 -08:00
2013-07-03 16:31:35 -07:00
2013-01-12 15:28:45 -08:00
2012-08-18 23:26:19 -07:00
2012-10-26 15:18:37 -07:00
2013-02-17 23:36:56 -05:00
2013-01-12 15:28:45 -08:00
2013-04-30 17:04:02 -07:00
2013-04-30 17:04:10 -07:00
2011-10-31 19:30:54 -04:00
2012-10-02 23:20:34 -04:00
2013-06-13 22:12:14 +01:00
2011-06-07 16:06:34 -07:00
2010-10-10 21:53:30 -06:00
2011-06-07 16:06:34 -07:00
2010-07-24 09:58:22 -06:00
2012-03-28 18:30:03 +01:00
2013-09-05 12:12:51 -07:00
2012-03-28 18:30:03 +01:00
2012-05-27 23:52:49 -07:00
2012-04-13 13:56:46 -07:00
2013-01-21 14:33:00 -08:00
2013-06-19 02:10:29 -07:00
2013-07-31 19:10:03 -07:00
2013-03-02 02:55:16 -05:00
2013-02-14 09:21:16 -05:00
2013-02-14 09:21:16 -05:00
2012-03-28 18:30:03 +01:00
2012-03-28 18:30:03 +01:00
2011-08-20 17:14:54 -07:00
2013-07-14 19:36:52 -04:00
2013-07-14 19:36:52 -04:00
2012-05-14 13:31:38 -07:00
2012-03-28 18:30:03 +01:00
2008-12-04 09:17:21 -08:00
2011-08-02 21:28:52 -07:00
2011-10-31 19:30:53 -04:00
2011-01-03 20:02:06 -07:00
2013-04-29 15:42:01 -04:00
2013-07-14 19:36:52 -04:00
2012-05-14 14:05:08 -07:00
2013-07-14 19:36:52 -04:00
2008-12-04 09:17:21 -08:00
2012-10-09 16:23:06 +09:00
2013-05-09 13:46:38 -04:00
2013-09-11 15:58:18 -07:00
2013-02-03 22:43:35 -05:00
2013-07-10 18:11:34 -07:00
2013-07-31 19:10:04 -07:00
2013-07-14 19:36:52 -04:00
2013-02-03 22:43:35 -05:00
2013-05-09 13:46:38 -04:00
2013-02-03 22:44:37 -05:00
2010-10-09 02:33:34 -06:00
2013-01-12 15:28:45 -08:00
2013-01-12 15:28:45 -08:00
2013-07-14 19:36:52 -04:00
2013-08-22 16:38:46 -07:00
2013-01-21 17:17:57 +10:30
2013-04-30 17:04:02 -07:00
2013-02-20 09:46:08 -08:00
2012-05-19 23:27:25 -07:00
2012-05-19 23:26:41 -07:00
2011-02-01 12:39:59 -08:00
2011-03-16 18:19:15 -07:00
2012-03-28 18:30:03 +01:00
2012-10-26 15:18:37 -07:00
2008-12-04 09:17:21 -08:00
2013-05-04 17:38:18 -07:00
2011-10-31 19:30:53 -04:00
2012-10-26 15:18:37 -07:00
2012-10-28 13:04:47 -07:00
2010-11-17 08:59:32 -08:00
2012-10-26 15:18:37 -07:00
2012-05-27 23:52:49 -07:00
2012-05-27 23:52:49 -07:00
3ddc5b46a8