diff mbox

[CVE-2017-100363,PATCHv2,T/Y/Z] char: lp: fix possible integer overflow in lp_setup()

Message ID 1496826321-29705-2-git-send-email-po-hsu.lin@canonical.com
State New
Headers show

Commit Message

Po-Hsu Lin June 7, 2017, 9:05 a.m. UTC 
From: Willy Tarreau <w@1wt.eu>

CVE-2017-100363

The lp_setup() code doesn't apply any bounds checking when passing
"lp=none", and only in this case, resulting in an overflow of the
parport_nr[] array. All versions in Git history are affected.

Reported-By: Roee Hay <roee.hay@hcl.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1)

Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
---
 drivers/char/lp.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Stefan Bader June 7, 2017, 9:30 a.m. UTC | #1
Colin Ian King June 7, 2017, 9:32 a.m. UTC | #2 
On 07/06/17 10:05, Po-Hsu Lin wrote:
> From: Willy Tarreau <w@1wt.eu>
> 
> CVE-2017-100363
> 
> The lp_setup() code doesn't apply any bounds checking when passing
> "lp=none", and only in this case, resulting in an overflow of the
> parport_nr[] array. All versions in Git history are affected.
> 
> Reported-By: Roee Hay <roee.hay@hcl.com>
> Cc: Ben Hutchings <ben@decadent.org.uk>
> Cc: stable@vger.kernel.org
> Signed-off-by: Willy Tarreau <w@1wt.eu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> (cherry picked from commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1)
> 
> Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
> ---
>  drivers/char/lp.c |    6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/char/lp.c b/drivers/char/lp.c
> index 0913d79..6b61910 100644
> --- a/drivers/char/lp.c
> +++ b/drivers/char/lp.c
> @@ -857,7 +857,11 @@ static int __init lp_setup (char *str)
>  	} else if (!strcmp(str, "auto")) {
>  		parport_nr[0] = LP_PARPORT_AUTO;
>  	} else if (!strcmp(str, "none")) {
> -		parport_nr[parport_ptr++] = LP_PARPORT_NONE;
> +		if (parport_ptr < LP_NO)
> +			parport_nr[parport_ptr++] = LP_PARPORT_NONE;
> +		else
> +			printk(KERN_INFO "lp: too many ports, %s ignored.\n",
> +			       str);
>  	} else if (!strcmp(str, "reset")) {
>  		reset = 1;
>  	}
> 

Looks good to me.

Acked-by: Colin Ian King <colin.king@canonical.com>
diff mbox

Patch

diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 0913d79..6b61910 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -857,7 +857,11 @@  static int __init lp_setup (char *str)
 	} else if (!strcmp(str, "auto")) {
 		parport_nr[0] = LP_PARPORT_AUTO;
 	} else if (!strcmp(str, "none")) {
-		parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		if (parport_ptr < LP_NO)
+			parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		else
+			printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+			       str);
 	} else if (!strcmp(str, "reset")) {
 		reset = 1;
 	}