leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bd23a72698
linux/drivers
History
Wenwen Wang bd23a72698 virt: vbox: Only copy_from_user the request-header once 
In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from
the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the
'version', 'size_in', and 'size_out' fields of 'hdr' are verified.

Before this commit, after the checks a buffer for the entire request would
be allocated and then all data including the verified header would be
copied from the userspace 'arg' pointer again.

Given that the 'arg' pointer resides in userspace, a malicious userspace
process can race to change the data pointed to by 'arg' between the two
copies. By doing so, the user can bypass the verifications on the ioctl
argument.

This commit fixes this by using the already checked copy of the header
to fill the header part of the allocated buffer and only copying the
remainder of the data from userspace.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-14 16:31:59 +02:00
..
accessibility
acpi ACPI fixes for 4.17-rc3 2018-04-26 11:06:36 -07:00
amba ARM: amba: Fix wrong indentation in driver_override_store() 2018-05-14 16:25:52 +02:00
android android: binder: Change return type to vm_fault_t 2018-05-14 16:06:48 +02:00
ata Merge branch 'for-4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2018-04-03 17:42:25 -07:00
atm atm: iphase: fix spelling mistake: "Tansmit" -> "Transmit" 2018-04-19 13:41:49 -04:00
auxdisplay
base Driver core fixes for 4.17-rc3 2018-04-27 10:12:20 -07:00
bcma
block for-linus-20180425 2018-04-25 21:05:15 -07:00
bluetooth Bluetooth: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for BTUSB_QCA_ROME 2018-04-01 21:43:02 +03:00
bus HISI LPC: Add Kconfig MFD_CORE dependency 2018-04-26 16:53:23 +02:00
cdrom cdrom: information leak in cdrom_ioctl_media_changed() 2018-04-18 08:21:32 -06:00
char Merge 4.17-rc3 into char-misc-next 2018-04-30 05:05:54 -07:00
clk The large diff this time around is from the addition of a new clk driver 2018-04-13 15:51:06 -07:00
clocksource clocksource/imx-tpm: Correct -ETIME return condition check 2018-04-19 13:21:35 +02:00
connector
cpufreq powerpc fixes for 4.17 #4 2018-04-28 09:45:34 -07:00
cpuidle cpuidle: menu: Avoid selecting shallow states with stopped tick 2018-04-09 11:54:57 +02:00
crypto .gitignore: move *-asn1.[ch] patterns to the top-level .gitignore 2018-04-07 19:04:02 +09:00
dax device-dax: allow MAP_SYNC to succeed 2018-04-19 15:11:50 -07:00
dca
devfreq
dio
dma DMAengine updates for v4.17-rc1 2018-04-10 12:14:37 -07:00
dma-buf
edac * Add NVDIMM support to EDAC (Tony Luck) 2018-04-05 14:21:13 -07:00
eisa
extcon Char/Misc patches for 4.17-rc1 2018-04-04 20:07:20 -07:00
firewire
firmware Merge 4.17-rc3 into char-misc-next 2018-04-30 05:05:54 -07:00
fmc treewide: Fix typos in printk 2018-03-27 09:51:22 +02:00
fpga Merge 4.17-rc3 into char-misc-next 2018-04-30 05:05:54 -07:00
fsi
gpio DeviceTree updates for 4.17: 2018-04-05 21:03:42 -07:00
gpu Merge tag 'drm-intel-fixes-2018-04-26' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes 2018-04-27 14:08:47 +10:00
hid HID: i2c-hid: fix inverted return value from i2c_hid_command() 2018-04-19 09:25:15 +02:00
hsi
hv Drivers: hv: vmbus: enable VMBus protocol version 5.0 2018-05-14 16:06:48 +02:00
hwmon hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics 2018-04-25 05:31:06 -07:00
hwspinlock
hwtracing coresight: Remove %px for printing pcsr value 2018-05-14 16:20:00 +02:00
i2c i2c: sprd: Fix the i2c count issue 2018-04-27 14:12:43 +02:00
ide for-4.17/block-20180402 2018-04-05 14:27:02 -07:00
idle
iio This is the bulk of GPIO changes for the v4.17 kernel cycle: 2018-04-05 09:51:41 -07:00
infiniband Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
input Revert: Unify CLOCK_MONOTONIC and CLOCK_BOOTTIME 2018-04-26 14:53:32 +02:00
iommu IOMMU Updates for Linux v4.17 2018-04-11 18:50:41 -07:00
ipack
irqchip IOMMU Updates for Linux v4.17 2018-04-11 18:50:41 -07:00
isdn mISDN: Remove VLAs 2018-04-12 21:46:10 -04:00
leds
lightnvm lightnvm: pblk: remove some unnecessary NULL checks 2018-03-29 17:29:09 -06:00
macintosh powerpc updates for 4.17 2018-04-07 12:08:19 -07:00
mailbox
mcb
md Merge tag 'md/4.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2018-04-20 10:39:44 -07:00
media remoteproc updates for v4.17 2018-04-10 12:09:27 -07:00
memory ARM: OMAP2+: Fix build when using split object directories 2018-04-18 10:07:13 -07:00
memstick
message scsi: mptsas: Disable WRITE SAME 2018-04-18 23:37:25 -04:00
mfd platform/chrome: mfd/cros_ec_dev: Add sysfs entry to set keyboard wake lid angle 2018-04-10 22:25:07 -07:00
misc misc: sgi-gru: Change return type to vm_fault_t 2018-05-14 16:25:52 +02:00
mmc MMC host: 2018-04-20 10:41:31 -07:00
mtd mtd: rawnand: marvell: fix the chip-select DT parsing logic 2018-04-26 19:06:42 +02:00
mux mux: adg792a: switch to using .probe_new 2018-04-23 13:31:27 +02:00
net Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue 2018-04-24 16:17:59 -04:00
nfc
ntb
nubus nubus: Call bus_register unconditionally 2018-05-14 16:27:08 +02:00
nvdimm Revert "libnvdimm, of_pmem: workaround OF_NUMA=n build error" 2018-04-19 15:10:56 -07:00
nvme nvme: expand nvmf_check_if_ready checks 2018-04-12 09:58:27 -06:00
nvmem nvmem: properly handle returned value nvmem_reg_read 2018-05-14 16:20:48 +02:00
of earlycon: Use a pointer table to fix __earlycon_table stride 2018-04-23 10:06:59 +02:00
opp
oprofile oprofilefs: don't oops on allocation failure 2018-03-29 15:07:48 -04:00
parisc parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode 2018-03-27 18:52:22 +02:00
parport Char/Misc patches for 4.17-rc1 2018-04-04 20:07:20 -07:00
pci pci-v4.17-fixes-1 2018-04-26 16:28:24 -07:00
pcmcia Merge branch 'for-linus-sa1100' of git://git.armlinux.org.uk/~rmk/linux-arm 2018-04-09 09:26:36 -07:00
perf ARM: SoC driver updates for 4.17 2018-04-05 21:29:35 -07:00
phy ARM: SoC platform updates for 4.17 2018-04-05 21:21:08 -07:00
pinctrl This is the bulk of GPIO changes for the v4.17 kernel cycle: 2018-04-05 09:51:41 -07:00
platform Changes to chrome-platform for v4.17 2018-04-13 16:20:36 -07:00
pnp
power ARM: SoC platform updates for 4.17 2018-04-05 21:21:08 -07:00
powercap
pps
ps3
ptp
pwm pwm: Changes for v4.17-rc1 2018-04-13 15:46:21 -07:00
rapidio rapidio: fix rio_dma_transfer error handling 2018-04-20 17:18:35 -07:00
ras
regulator Merge remote-tracking branches 'regulator/topic/88pg86x', 'regulator/topic/dt', 'regulator/topic/formatting' and 'regulator/topic/gpio' into regulator-next 2018-03-28 10:33:53 +08:00
remoteproc remoteproc: fix null pointer dereference on glink only platforms 2018-04-05 22:53:16 -07:00
reset Merge branch 'reset/lookup' into reset/next 2018-03-27 11:03:43 +02:00
rpmsg rpmsg: smd: Use announce_create to process any receive work 2018-03-27 21:54:37 -07:00
rtc rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops 2018-04-25 13:24:13 +10:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2018-04-26 10:29:46 -07:00
sbus sparc64: Properly range check DAX completion index 2018-04-01 20:07:00 -04:00
scsi scsi: sd_zbc: Avoid that resetting a zone fails sporadically 2018-04-19 00:04:10 -04:00
sfi
sh
siox
slimbus slimbus: qcom: remove unused variable 2018-05-14 16:23:15 +02:00
sn
soc soc: bcm: raspberrypi-power: Fix use of __packed 2018-04-16 15:15:23 -07:00
soundwire soundwire: intel: Add audio DAI ops 2018-05-11 21:48:07 +05:30
spi spi: SPI updates for v4.17 2018-04-03 12:06:21 -07:00
spmi
ssb
staging staging: wilc1000: fix NULL pointer exception in host_int_parse_assoc_resp_info() 2018-04-23 15:57:38 +02:00
target scsi: target: fix crash with iscsi target and dvd 2018-04-19 00:41:03 -04:00
tc
tee
thermal Merge branches 'thermal-core' and 'thermal-soc' into next 2018-04-13 14:11:53 +08:00
thunderbolt
tty tty: Use __GFP_NOFAIL for tty_ldisc_get() 2018-04-25 15:03:44 +02:00
uio uio: Prevent device destruction while fds are open 2018-05-14 16:16:35 +02:00
usb USB-serial fixes for v4.17-rc3 2018-04-26 19:29:24 +02:00
uwb
vfio VFIO updates for v4.17-rc1 2018-04-06 19:44:27 -07:00
vhost vhost: return bool from *_access_ok() functions 2018-04-11 10:54:06 -04:00
video fbdev changes for v4.17: 2018-04-10 10:20:00 -07:00
virt virt: vbox: Only copy_from_user the request-header once 2018-05-14 16:31:59 +02:00
virtio virtio: feature 2018-04-11 18:58:27 -07:00
visorbus
vlynq
vme
w1
watchdog aspeed: watchdog: Set bootstatus during probe 2018-04-16 10:22:40 +02:00
xen xen: fixes and one header update for 4.17-rc2 2018-04-20 08:36:04 -07:00
zorro
Kconfig hwtracing: Add HW tracing support menu 2018-03-29 13:38:10 +03:00
Makefile