lkml.org 
[lkml]   [2011]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[027/143] [SCSI] mpt2sas: prevent heap overflows and unchecked reads
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream.

    At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
    length values are used to copy data from userspace into heap buffers
    without bounds checking, allowing controllable heap corruption and
    subsequently privilege escalation.

    Additionally, user-supplied values are used to determine the size of a
    copy_to_user() as well as the offset into the buffer to be read, with no
    bounds checking, allowing users to read arbitrary kernel memory.

    Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
    Acked-by: Eric Moore <eric.moore@lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/scsi/mpt2sas/mpt2sas_ctl.c | 23 +++++++++++++++++++++--
    1 file changed, 21 insertions(+), 2 deletions(-)

    --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
    +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
    @@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT
    data_out_sz = karg.data_out_size;
    data_in_sz = karg.data_in_size;

    + /* Check for overflow and wraparound */
    + if (karg.data_sge_offset * 4 > ioc->request_sz ||
    + karg.data_sge_offset > (UINT_MAX / 4)) {
    + ret = -EINVAL;
    + goto out;
    + }
    +
    /* copy in request message frame from user */
    if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
    printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
    @@ -1809,7 +1816,7 @@ _ctl_diag_read_buffer(void __user *arg,
    Mpi2DiagBufferPostReply_t *mpi_reply;
    int rc, i;
    u8 buffer_type;
    - unsigned long timeleft;
    + unsigned long timeleft, request_size, copy_size;
    u16 smid;
    u16 ioc_status;
    u8 issue_reset = 0;
    @@ -1845,6 +1852,8 @@ _ctl_diag_read_buffer(void __user *arg,
    return -ENOMEM;
    }

    + request_size = ioc->diag_buffer_sz[buffer_type];
    +
    if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
    printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
    "or bytes_to_read are not 4 byte aligned\n", ioc->name,
    @@ -1852,13 +1861,23 @@ _ctl_diag_read_buffer(void __user *arg,
    return -EINVAL;
    }

    + if (karg.starting_offset > request_size)
    + return -EINVAL;
    +
    diag_data = (void *)(request_data + karg.starting_offset);
    dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
    "offset(%d), sz(%d)\n", ioc->name, __func__,
    diag_data, karg.starting_offset, karg.bytes_to_read));

    + /* Truncate data on requests that are too large */
    + if ((diag_data + karg.bytes_to_read < diag_data) ||
    + (diag_data + karg.bytes_to_read > request_data + request_size))
    + copy_size = request_size - karg.starting_offset;
    + else
    + copy_size = karg.bytes_to_read;
    +
    if (copy_to_user((void __user *)uarg->diagnostic_data,
    - diag_data, karg.bytes_to_read)) {
    + diag_data, copy_size)) {
    printk(MPT2SAS_ERR_FMT "%s: Unable to write "
    "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
    __func__, diag_data);



    \
     
     \ /
      Last update: 2011-05-06 02:27    [W:0.023 / U:0.948 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site