lkml.org 
[lkml]   [2010]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH v3] firewire: cdev: check write quadlet request length to avoid buffer overflow
    Check that the data length of a write quadlet request actually is large
    enough for a quadlet. Otherwise, fw_fill_request could access the four
    bytes after the end of the outbound_transaction_event structure.

    Reported-by: Clemens Ladisch <clemens@ladisch.de>

    Since struct outbound_transaction_event *e is slab-allocated, such an
    access may hit unallocated memory only if sizeof(*e) == 256 or 512 or
    any other power of 2 above 2**2. In kernel 2.6.34, sizeof(*e) is > 128
    and < 256 on 32bit architectures, and > 256 and < 512 on 64bit
    architectures. Thus the only problem is that a bogus write quadlet
    request with user-specified length of < 3 will put 1...4 random bytes
    into the packet payload. But this is the user's problem then, not the
    kernel's.

    Hence the corner case handling can be optimized by a size is_power_of_2
    check. This is a constant expression and will cause the whole check to
    be omitted by the compiler's dead code elimination.

    Of course this relies on certain behavior of the slab allocator.

    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    ---
    drivers/firewire/core-cdev.c | 6 ++++++
    1 file changed, 6 insertions(+)

    Index: b/drivers/firewire/core-cdev.c
    ===================================================================
    --- a/drivers/firewire/core-cdev.c
    +++ b/drivers/firewire/core-cdev.c
    @@ -29,6 +29,7 @@
    #include <linux/jiffies.h>
    #include <linux/kernel.h>
    #include <linux/kref.h>
    +#include <linux/log2.h>
    #include <linux/mm.h>
    #include <linux/module.h>
    #include <linux/mutex.h>
    @@ -564,6 +565,11 @@ static int init_request(struct client *c
    (request->length > 4096 || request->length > 512 << speed))
    return -EIO;

    + /* Corner case: Access past the end of *e in fw_fill_request() */
    + if (request->tcode == TCODE_WRITE_QUADLET_REQUEST &&
    + request->length < 4 && is_power_of_2(sizeof(*e)))
    + return -EINVAL;
    +
    e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);
    if (e == NULL)
    return -ENOMEM;
    --
    Stefan Richter
    -=====-==-=- -=== --===
    http://arcgraph.de/sr/


    \
     
     \ /
      Last update: 2010-07-07 12:05    [W:0.021 / U:0.072 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site