From a4f2846fa82cfe28fc46ff7d5f52dc873a1d7f85 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 5 May 2017 15:35:28 -0700 Subject: [PATCH] 4.11-stable patches added patches: dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch --- ...-prevent-stack-leak-in-dm-ioctl-call.patch | 36 +++++++++++++++++++ queue-4.11/series | 1 + 2 files changed, 37 insertions(+) create mode 100644 queue-4.11/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch diff --git a/queue-4.11/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch b/queue-4.11/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch new file mode 100644 index 00000000000..77290324b04 --- /dev/null +++ b/queue-4.11/dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch @@ -0,0 +1,36 @@ +From 4617f564c06117c7d1b611be49521a4430042287 Mon Sep 17 00:00:00 2001 +From: Adrian Salido +Date: Thu, 27 Apr 2017 10:32:55 -0700 +Subject: dm ioctl: prevent stack leak in dm ioctl call + +From: Adrian Salido + +commit 4617f564c06117c7d1b611be49521a4430042287 upstream. + +When calling a dm ioctl that doesn't process any data +(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct +dm_ioctl are left initialized. Current code is incorrectly extending +the size of data copied back to user, causing the contents of kernel +stack to be leaked to user. Fix by only copying contents before data +and allow the functions processing the ioctl to override. + +Signed-off-by: Adrian Salido +Reviewed-by: Alasdair G Kergon +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1848,7 +1848,7 @@ static int ctl_ioctl(uint command, struc + if (r) + goto out; + +- param->data_size = sizeof(*param); ++ param->data_size = offsetof(struct dm_ioctl, data); + r = fn(param, input_param_size); + + if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) && diff --git a/queue-4.11/series b/queue-4.11/series index e69de29bb2d..54439a5c6ff 100644 --- a/queue-4.11/series +++ b/queue-4.11/series @@ -0,0 +1 @@ +dm-ioctl-prevent-stack-leak-in-dm-ioctl-call.patch -- 2.47.2