The patch titled
Subject: autofs: fix slab out of bounds read in getname_kernel()
has been added to the -mm tree. Its filename is
autofs-fix-slab-out-of-bounds-read-in-getname_kernel.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/autofs-fix-slab-out-of-bounds-read-in-getname_kernel.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/autofs-fix-slab-out-of-bounds-read-in-getname_kernel.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Ian Kent <raven@xxxxxxxxxx>
Subject: autofs: fix slab out of bounds read in getname_kernel()
Initial patch contributed by Tomas Bortoli.
The autofs subsystem does not check that the "path" parameter is present
for all cases where it is required when it is passed in via the "param"
struct.
In particular it isn't checked for the AUTOFS_DEV_IOCTL_OPENMOUNT_CMD
ioctl command.
To solve it, modify validate_dev_ioctl(function to check that a path has
been provided for ioctl commands that require it.
Link: http://lkml.kernel.org/r/153060031527.26631.18306637892746301555.stgit@xxxxxxxxxxxxxxxx
Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Signed-off-by: Ian Kent <raven@xxxxxxxxxx>
Reported-by: syzbot+60c837b428dc84e83a93@xxxxxxxxxxxxxxxxxxxxxxxxx
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
diff -puN fs/autofs/dev-ioctl.c~autofs-fix-slab-out-of-bounds-read-in-getname_kernel fs/autofs/dev-ioctl.c
--- a/fs/autofs/dev-ioctl.c~autofs-fix-slab-out-of-bounds-read-in-getname_kernel
+++ a/fs/autofs/dev-ioctl.c
@@ -135,6 +135,15 @@ static int validate_dev_ioctl(int cmd, s
cmd);
goto out;
}
+ } else {
+ unsigned int inr = _IOC_NR(cmd);
+
+ if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD ||
+ inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD ||
+ inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) {
+ err = -EINVAL;
+ goto out;
+ }
}
err = 0;
@@ -271,7 +280,8 @@ static int autofs_dev_ioctl_openmount(st
dev_t devid;
int err, fd;
- /* param->path has already been checked */
+ /* param->path has been checked in validate_dev_ioctl() */
+
if (!param->openmount.devid)
return -EINVAL;
@@ -433,10 +443,7 @@ static int autofs_dev_ioctl_requester(st
dev_t devid;
int err = -ENOENT;
- if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
- err = -EINVAL;
- goto out;
- }
+ /* param->path has been checked in validate_dev_ioctl() */
devid = sbi->sb->s_dev;
@@ -521,10 +528,7 @@ static int autofs_dev_ioctl_ismountpoint
unsigned int devid, magic;
int err = -ENOENT;
- if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
- err = -EINVAL;
- goto out;
- }
+ /* param->path has been checked in validate_dev_ioctl() */
name = param->path;
type = param->ismountpoint.in.type;
_
Patches currently in -mm which might be from raven@xxxxxxxxxx are
autofs-fix-slab-out-of-bounds-read-in-getname_kernel.patch
autofs-fix-directory-and-symlink-access.patch
autofs-fix-inconsistent-use-of-now-variable.patch
autofs-fix-clearing-autofs_exp_leaves-in-autofs_expire_indirect.patch
autofs-make-autofs_expire_direct-static.patch
autofs-make-autofs_expire_indirect-static.patch
autofs-make-expire-flags-usage-consistent-with-v5-params.patch
autofs-add-autofs_exp_forced-flag.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
