linux/arch/sparc
Mathieu Desnoyers 3ddc5b46a8 kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()
I found the following pattern that leads in to interesting findings:

  grep -r "ret.*|=.*__put_user" *
  grep -r "ret.*|=.*__get_user" *
  grep -r "ret.*|=.*__copy" *

The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat,
since those appear in compat code, we could probably expect the kernel
addresses not to be reachable in the lower 32-bit range, so I think they
might not be exploitable.

For the "__get_user" cases, I don't think those are exploitable: the worse
that can happen is that the kernel will copy kernel memory into in-kernel
buffers, and will fail immediately afterward.

The alpha csum_partial_copy_from_user() seems to be missing the
access_ok() check entirely.  The fix is inspired from x86.  This could
lead to information leak on alpha.  I also noticed that many architectures
map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I
wonder if the latter is performing the access checks on every
architectures.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-09-11 15:58:18 -07:00
..
boot sparc: Fix piggyback with newer binutils. 2012-12-03 11:24:25 -08:00
configs perf: Remove PERF_COUNTERS config option 2012-04-26 13:52:52 +02:00
crypto sparc64: Set CRYPTO_TFM_REQ_MAY_SLEEP consistently in CAMELLIA code. 2012-12-19 15:44:31 -08:00
include sparc64: cleanup: Rename ret_from_syscall to ret_from_fork 2013-07-31 19:10:04 -07:00
kernel kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() 2013-09-11 15:58:18 -07:00
lib sparc64: Remove RWSEM export leftovers 2013-09-05 12:12:51 -07:00
math-emu sparc64: Make montmul/montsqr/mpmul usable in 32-bit threads. 2012-10-26 15:18:37 -07:00
mm mm: migrate: check movability of hugepage in unmap_and_move_huge_page() 2013-09-11 15:57:49 -07:00
net sparc: bpf_jit_comp: can call module_free() from any context 2013-05-17 18:27:52 -07:00
oprofile
power sparc64: Hibernation support 2013-03-20 11:06:54 -07:00
prom arch: sparc: prom: looping issue, need additional length check in the outside looping 2013-06-19 02:10:29 -07:00
Kbuild sparc64: Add SHA1 driver making use of the 'sha1' instruction. 2012-08-20 15:08:49 -07:00
Kconfig PCI: remove ARCH_SUPPORTS_MSI kconfig option 2013-08-12 15:26:48 +00:00
Kconfig.debug lib: consolidate DEBUG_STACK_USAGE option 2011-05-25 08:39:54 -07:00
Makefile sparc64: Hibernation support 2013-03-20 11:06:54 -07:00