From patchwork Tue Jun 20 08:58:39 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Po-Hsu Lin X-Patchwork-Id: 778172 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3wsMGJ3Rc1z9s7M; Tue, 20 Jun 2017 18:59:04 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical-com.20150623.gappssmtp.com header.i=@canonical-com.20150623.gappssmtp.com header.b="P5pGcRCd"; dkim-atps=neutral Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1dNF01-0005rn-L0; Tue, 20 Jun 2017 08:59:01 +0000 Received: from mail-pg0-f44.google.com ([74.125.83.44]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1dNEzs-0005q8-MQ for kernel-team@lists.ubuntu.com; Tue, 20 Jun 2017 08:58:52 +0000 Received: by mail-pg0-f44.google.com with SMTP id f185so59916773pgc.0 for ; Tue, 20 Jun 2017 01:58:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references; bh=xN3X40bJ9Ukq5nBB2KL9E9f2L3y2DpB+BdRuAcHBOmI=; b=P5pGcRCdGXHlyR+e7NLDgumJ7ZIZtww9fUgmsfSIMjCXnNL9pBLpwlhzZ+AMW8N0uF qh6QRwV57QaTT+/IarHePWR9bdi+crDntElvyBMfj99CWVCz/s6tLgnbyKvZo1rUu/Wr /JENkWbkToJyVFem+UyyViNDT4zw9gxggQdBh9FP3wAEJbbxwYs3Ai3Wgp4h4cDMsp3d zL0wQozp5nzZuzVjWWaLfmZcqhxBWb3AT+RerhkDF+tIyKQ6qsNuL0VjfhPMY3EiitHx DkXHUzu3yIK22/efSSEErGC0i57TbqnyNqm5y4osOYCtEJnzfiuUYHNjp3m3uQvGqhg8 j3XA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=xN3X40bJ9Ukq5nBB2KL9E9f2L3y2DpB+BdRuAcHBOmI=; b=pTHxYs145sRcDnG/kuQ9eLkwrKiWhLZRG1nd9dgUm0kSrBpeB36HW2uPnmJhKt+kjn VJIq0rT06iwyVlsy7lEiI5+2fVIHRgrEXKaUul94UskJ4+sDfaYVQfwqJdcd5we9F+xo 7qSmCWPH7asQeFnZj9D0rrMRFLAOxEPvaA7qLGNTCQk/qDCmfHIZrTLrV//h0Ov54jrp 5k4MSN/TeU2tEzaiXhpx7fLpuXjZeHC17prVCu4aoOHxEKsuidw8xBWA+AePCwzRufsg zivwE9mt1R13AWYRbUearmsZfNZGnz23N1QoSYghAGkwwM0+An6FnMoLqPwqzzGKsrAg Ze+g== X-Gm-Message-State: AKS2vOybGNMmRMG1iVcU+0m5JB50GNwxYTfVTWnBFDC99eHjbcOtmWyS jNyk6xfUbQdfAhBUBh8= X-Received: by 10.84.225.145 with SMTP id u17mr3509212plj.255.1497949131239; Tue, 20 Jun 2017 01:58:51 -0700 (PDT) Received: from localhost.localdomain ([175.41.48.77]) by smtp.gmail.com with ESMTPSA id c4sm27217358pfg.31.2017.06.20.01.58.50 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Jun 2017 01:58:50 -0700 (PDT) From: Po-Hsu Lin To: kernel-team@lists.ubuntu.com Subject: [CVE-2016-10088][PATCH Trusty] sg_write()/bsg_write() is not fit to be called under KERNEL_DS Date: Tue, 20 Jun 2017 16:58:39 +0800 Message-Id: <1497949119-21068-2-git-send-email-po-hsu.lin@canonical.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1497949119-21068-1-git-send-email-po-hsu.lin@canonical.com> References: <1497949119-21068-1-git-send-email-po-hsu.lin@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Al Viro CVE-2016-10088 Both damn things interpret userland pointers embedded into the payload; worse, they are actually traversing those. Leaving aside the bad API design, this is very much _not_ safe to call with KERNEL_DS. Bail out early if that happens. Cc: stable@vger.kernel.org Signed-off-by: Al Viro (cherry picked from commit 128394eff343fc6d2f32172f03e24829539c5835) Signed-off-by: Po-Hsu Lin Acked-by: Stefan Bader Acked-by: Colin Ian King --- block/bsg.c | 3 +++ drivers/scsi/sg.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/block/bsg.c b/block/bsg.c index 420a5a9..76801e5 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -675,6 +675,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) dprintk("%s: write %Zd bytes\n", bd->name, count); + if (unlikely(segment_eq(get_fs(), KERNEL_DS))) + return -EINVAL; + bsg_set_block(bd, file); bytes_written = 0; diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 1f65e32..291791a 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -568,6 +568,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) sg_io_hdr_t *hp; unsigned char cmnd[MAX_COMMAND_SIZE]; + if (unlikely(segment_eq(get_fs(), KERNEL_DS))) + return -EINVAL; + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) return -ENXIO; SCSI_LOG_TIMEOUT(3, printk("sg_write: %s, count=%d\n",