From e2c7930ec53f415945ba1106d2ee1496970bf5a7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 11 Aug 2015 15:34:35 -0700 Subject: [PATCH] 3.14-stable patches added patches: md-use-kzalloc-when-bitmap-is-disabled.patch --- ...-use-kzalloc-when-bitmap-is-disabled.patch | 50 +++++++++++++++++++ queue-3.14/series | 1 + 2 files changed, 51 insertions(+) create mode 100644 queue-3.14/md-use-kzalloc-when-bitmap-is-disabled.patch diff --git a/queue-3.14/md-use-kzalloc-when-bitmap-is-disabled.patch b/queue-3.14/md-use-kzalloc-when-bitmap-is-disabled.patch new file mode 100644 index 00000000000..766f5cf4cf5 --- /dev/null +++ b/queue-3.14/md-use-kzalloc-when-bitmap-is-disabled.patch @@ -0,0 +1,50 @@ +From b6878d9e03043695dbf3fa1caa6dfc09db225b16 Mon Sep 17 00:00:00 2001 +From: Benjamin Randazzo +Date: Sat, 25 Jul 2015 16:36:50 +0200 +Subject: md: use kzalloc() when bitmap is disabled + +From: Benjamin Randazzo + +commit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream. + +In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a +mdu_bitmap_file_t called "file". + +5769 file = kmalloc(sizeof(*file), GFP_NOIO); +5770 if (!file) +5771 return -ENOMEM; + +This structure is copied to user space at the end of the function. + +5786 if (err == 0 && +5787 copy_to_user(arg, file, sizeof(*file))) +5788 err = -EFAULT + +But if bitmap is disabled only the first byte of "file" is initialized +with zero, so it's possible to read some bytes (up to 4095) of kernel +space memory from user space. This is an information leak. + +5775 /* bitmap disabled, zero the first byte and copy out */ +5776 if (!mddev->bitmap_info.file) +5777 file->pathname[0] = '\0'; + +Signed-off-by: Benjamin Randazzo +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5645,8 +5645,7 @@ static int get_bitmap_file(struct mddev + char *ptr, *buf = NULL; + int err = -ENOMEM; + +- file = kmalloc(sizeof(*file), GFP_NOIO); +- ++ file = kzalloc(sizeof(*file), GFP_NOIO); + if (!file) + goto out; + diff --git a/queue-3.14/series b/queue-3.14/series index bb8a42a2f36..afd473ce99f 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -11,3 +11,4 @@ xhci-fix-off-by-one-error-in-trb-dma-address-boundary-check.patch usb-sierra-add-1199-68ab-device-id.patch ima-add-support-for-new-euid-policy-condition.patch ima-extend-mask-policy-matching-support.patch +md-use-kzalloc-when-bitmap-is-disabled.patch -- 2.47.2