From: Greg Kroah-Hartman Date: Fri, 5 May 2017 22:35:14 +0000 (-0700) Subject: 3.18-stable patches X-Git-Tag: v3.18.52~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=319795358dac22f575c32ce1d84b06bca66396f7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch --- diff --git a/queue-3.18/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch b/queue-3.18/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch new file mode 100644 index 00000000000..6825fea3e28 --- /dev/null +++ b/queue-3.18/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch @@ -0,0 +1,36 @@ +From 4617f564c06117c7d1b611be49521a4430042287 Mon Sep 17 00:00:00 2001 +From: Adrian Salido +Date: Thu, 27 Apr 2017 10:32:55 -0700 +Subject: dm ioctl: prevent stack leak in dm ioctl call + +From: Adrian Salido + +commit 4617f564c06117c7d1b611be49521a4430042287 upstream. + +When calling a dm ioctl that doesn't process any data +(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct +dm_ioctl are left initialized. Current code is incorrectly extending +the size of data copied back to user, causing the contents of kernel +stack to be leaked to user. Fix by only copying contents before data +and allow the functions processing the ioctl to override. + +Signed-off-by: Adrian Salido +Reviewed-by: Alasdair G Kergon +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1839,7 +1839,7 @@ static int ctl_ioctl(uint command, struc + if (r) + goto out; + +- param->data_size = sizeof(*param); ++ param->data_size = offsetof(struct dm_ioctl, data); + r = fn(param, input_param_size); + + if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) && diff --git a/queue-3.18/series b/queue-3.18/series index 3fbce045060..f47c00faacf 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -65,3 +65,4 @@ cpumask_set_cpu_local_first-cpumask_local_spread-lament.patch e1000e-fix-call-to-do_div-to-use-u64-arg.patch gfs2-remove-is_err_value-abuse.patch kbuild-mergeconfig-fix-jobserver-unavailable-warning.patch +dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch