On Mon, 25 Apr 2016 15:36:44 +0100 Pengfei Wang <wpengfeinudt@xxxxxxxxx> wrote: > I found this Double-Fetch bug in Linux-4.5/drivers/s390/char/sclp_ctl.c > when I was examining the source code. > > In function sclp_ctl_ioctl_sccb(), the driver fetches user space data by > pointer ctl_sccb.sccb via copy_from_user(), and this happens twice at > line 68 and line 74 respectively. The first fetched value (stored in sccb) > is used to get the length element (sccb->length) so as to copy the whole > message later at line 74, which means the copy size of the whole message > is based on the old value that came from the first fetch. Besides, the > whole message copied in the second fetch also contains sccb->length. > > However, when the function copies the whole message back to user space > after the second fetch at line 78, it uses sccb->length that came from > the second fetch, which might be different from the one came from the > first fetch as well as copied the message from user space to driver. > This is definitely a bug. The copy_to_user for the result might use a different length than the value retrieved with the initial copy_from_user. > If the sccb->length is modified by a user thread under race condition > between the fetch operations, for example changing to a very large value, > this will lead to consequence like over-boundary access on the buffer, > information leakage. Correct. Fortunately the device node is created with file permissions 0600, only the owner can access the interface. Unless someone changed the owner the interface is root only. We will fix this. -- blue skies, Martin. "Reality continues to ruin my life." - Calvin. -- To unsubscribe from this list: send the line "unsubscribe linux-s390" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
