4.10-stable patches

added patches:
	dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch

diff --git a/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch b/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch
new file mode 100644 (file)
index 0000000..9e8521b
--- /dev/null
+++ b/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch
@@ -0,0 +1,36 @@
+From 4617f564c06117c7d1b611be49521a4430042287 Mon Sep 17 00:00:00 2001
+From: Adrian Salido <salidoa@google.com>
+Date: Thu, 27 Apr 2017 10:32:55 -0700
+Subject: dm ioctl: prevent stack leak in dm ioctl call
+
+From: Adrian Salido <salidoa@google.com>
+
+commit 4617f564c06117c7d1b611be49521a4430042287 upstream.
+
+When calling a dm ioctl that doesn't process any data
+(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct
+dm_ioctl are left initialized.  Current code is incorrectly extending
+the size of data copied back to user, causing the contents of kernel
+stack to be leaked to user.  Fix by only copying contents before data
+and allow the functions processing the ioctl to override.
+
+Signed-off-by: Adrian Salido <salidoa@google.com>
+Reviewed-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-ioctl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1847,7 +1847,7 @@ static int ctl_ioctl(uint command, struc
+       if (r)
+               goto out;
+ 
+-      param->data_size = sizeof(*param);
++      param->data_size = offsetof(struct dm_ioctl, data);
+       r = fn(param, input_param_size);
+ 
+       if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&

diff --git a/queue-4.10/series b/queue-4.10/series
index 1cae429c334f1c3f0f14e992758a7175c02dfcf6..3ee19bd6c69f1fc9693f2486a6a381d22ec785b4 100644 (file)
--- a/queue-4.10/series
+++ b/queue-4.10/series
@@ -2,3 +2,4 @@ timerfd-protect-the-might-cancel-mechanism-proper.patch
 handle-mismatched-open-calls.patch
 scsi-storvsc-workaround-for-virtual-dvd-scsi-version.patch
 hwmon-it87-avoid-registering-the-same-chip-on-both-sio-addresses.patch
+dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch