From: Greg Kroah-Hartman Date: Fri, 5 May 2017 22:35:21 +0000 (-0700) Subject: 4.10-stable patches X-Git-Tag: v3.18.52~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8689e6f00eea780eac706f5fea9557e325ce1445;p=thirdparty%2Fkernel%2Fstable-queue.git 4.10-stable patches added patches: dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch --- diff --git a/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch b/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch new file mode 100644 index 00000000000..9e8521b6506 --- /dev/null +++ b/queue-4.10/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch @@ -0,0 +1,36 @@ +From 4617f564c06117c7d1b611be49521a4430042287 Mon Sep 17 00:00:00 2001 +From: Adrian Salido +Date: Thu, 27 Apr 2017 10:32:55 -0700 +Subject: dm ioctl: prevent stack leak in dm ioctl call + +From: Adrian Salido + +commit 4617f564c06117c7d1b611be49521a4430042287 upstream. + +When calling a dm ioctl that doesn't process any data +(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct +dm_ioctl are left initialized. Current code is incorrectly extending +the size of data copied back to user, causing the contents of kernel +stack to be leaked to user. Fix by only copying contents before data +and allow the functions processing the ioctl to override. + +Signed-off-by: Adrian Salido +Reviewed-by: Alasdair G Kergon +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1847,7 +1847,7 @@ static int ctl_ioctl(uint command, struc + if (r) + goto out; + +- param->data_size = sizeof(*param); ++ param->data_size = offsetof(struct dm_ioctl, data); + r = fn(param, input_param_size); + + if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) && diff --git a/queue-4.10/series b/queue-4.10/series index 1cae429c334..3ee19bd6c69 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -2,3 +2,4 @@ timerfd-protect-the-might-cancel-mechanism-proper.patch handle-mismatched-open-calls.patch scsi-storvsc-workaround-for-virtual-dvd-scsi-version.patch hwmon-it87-avoid-registering-the-same-chip-on-both-sio-addresses.patch +dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch