lkml.org 
[lkml]   [2018]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 69/70] fs/binfmt_misc.c: do not allow offset overflow
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

    commit 5cc41e099504b77014358b58567c5ea6293dd220 upstream.

    WHen registering a new binfmt_misc handler, it is possible to overflow
    the offset to get a negative value, which might crash the system, or
    possibly leak kernel data.

    Here is a crash log when 2500000000 was used as an offset:

    BUG: unable to handle kernel paging request at ffff989cfd6edca0
    IP: load_misc_binary+0x22b/0x470 [binfmt_misc]
    PGD 1ef3e067 P4D 1ef3e067 PUD 0
    Oops: 0000 [#1] SMP NOPTI
    Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy
    CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
    RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc]
    Call Trace:
    search_binary_handler+0x97/0x1d0
    do_execveat_common.isra.34+0x667/0x810
    SyS_execve+0x31/0x40
    do_syscall_64+0x73/0x130
    entry_SYSCALL_64_after_hwframe+0x3d/0xa2

    Use kstrtoint instead of simple_strtoul. It will work as the code
    already set the delimiter byte to '\0' and we only do it when the field
    is not empty.

    Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX. Also tested
    with examples documented at Documentation/admin-guide/binfmt-misc.rst
    and other registrations from packages on Ubuntu.

    Link: http://lkml.kernel.org/r/20180529135648.14254-1-cascardo@canonical.com
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/binfmt_misc.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    --- a/fs/binfmt_misc.c
    +++ b/fs/binfmt_misc.c
    @@ -387,8 +387,13 @@ static Node *create_entry(const char __u
    s = strchr(p, del);
    if (!s)
    goto einval;
    - *s++ = '\0';
    - e->offset = simple_strtoul(p, &p, 10);
    + *s = '\0';
    + if (p != s) {
    + int r = kstrtoint(p, 10, &e->offset);
    + if (r != 0 || e->offset < 0)
    + goto einval;
    + }
    + p = s;
    if (*p++)
    goto einval;
    pr_debug("register: offset: %#x\n", e->offset);
    @@ -428,7 +433,8 @@ static Node *create_entry(const char __u
    if (e->mask &&
    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
    goto einval;
    - if (e->size + e->offset > BINPRM_BUF_SIZE)
    + if (e->size > BINPRM_BUF_SIZE ||
    + BINPRM_BUF_SIZE - e->size < e->offset)
    goto einval;
    pr_debug("register: magic/mask length: %i\n", e->size);
    if (USE_DEBUG) {

    \
     
     \ /
      Last update: 2018-06-24 17:49    [W:4.181 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site