71 lines
2.1 KiB
Diff
71 lines
2.1 KiB
Diff
|
From 77ba0569d4c8389c0a2162ab0c7c16a6f3b199e4 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Benjamin Randazzo <benjamin@randazzo.fr>
|
||
|
|
Date: Sat, 25 Jul 2015 16:36:50 +0200
|
||
|
|
Subject: md: use kzalloc() when bitmap is disabled
|
||
|
|
|
||
|
|
In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
|
||
|
|
mdu_bitmap_file_t called "file".
|
||
|
|
|
||
|
|
5769 file = kmalloc(sizeof(*file), GFP_NOIO);
|
||
|
|
5770 if (!file)
|
||
|
|
5771 return -ENOMEM;
|
||
|
|
|
||
|
|
This structure is copied to user space at the end of the function.
|
||
|
|
|
||
|
|
5786 if (err == 0 &&
|
||
|
|
5787 copy_to_user(arg, file, sizeof(*file)))
|
||
|
|
5788 err = -EFAULT
|
||
|
|
|
||
|
|
But if bitmap is disabled only the first byte of "file" is initialized
|
||
|
|
with zero, so it's possible to read some bytes (up to 4095) of kernel
|
||
|
|
space memory from user space. This is an information leak.
|
||
|
|
|
||
|
|
5775 /* bitmap disabled, zero the first byte and copy out */
|
||
|
|
5776 if (!mddev->bitmap_info.file)
|
||
|
|
5777 file->pathname[0] = '\0';
|
||
|
|
|
||
|
|
Signed-off-by: Benjamin Randazzo <benjamin@randazzo.fr>
|
||
|
|
Signed-off-by: NeilBrown <neilb@suse.com>
|
||
|
|
|
||
|
|
diff --git a/drivers/md/md.c b/drivers/md/md.c
|
||
|
|
index ce4cb8b..cdc080b 100644
|
||
|
|
--- a/drivers/md/md.c
|
||
|
|
+++ b/drivers/md/md.c
|
||
|
|
@@ -5765,22 +5765,22 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
|
||
|
|
char *ptr;
|
||
|
|
int err;
|
||
|
|
|
||
|
|
- file = kmalloc(sizeof(*file), GFP_NOIO);
|
||
|
|
+ file = kzalloc(sizeof(*file), GFP_NOIO);
|
||
|
|
if (!file)
|
||
|
|
return -ENOMEM;
|
||
|
|
|
||
|
|
err = 0;
|
||
|
|
spin_lock(&mddev->lock);
|
||
|
|
- /* bitmap disabled, zero the first byte and copy out */
|
||
|
|
- if (!mddev->bitmap_info.file)
|
||
|
|
- file->pathname[0] = '\0';
|
||
|
|
- else if ((ptr = file_path(mddev->bitmap_info.file,
|
||
|
|
- file->pathname, sizeof(file->pathname))),
|
||
|
|
- IS_ERR(ptr))
|
||
|
|
- err = PTR_ERR(ptr);
|
||
|
|
- else
|
||
|
|
- memmove(file->pathname, ptr,
|
||
|
|
- sizeof(file->pathname)-(ptr-file->pathname));
|
||
|
|
+ /* bitmap enabled */
|
||
|
|
+ if (mddev->bitmap_info.file) {
|
||
|
|
+ ptr = file_path(mddev->bitmap_info.file, file->pathname,
|
||
|
|
+ sizeof(file->pathname));
|
||
|
|
+ if (IS_ERR(ptr))
|
||
|
|
+ err = PTR_ERR(ptr);
|
||
|
|
+ else
|
||
|
|
+ memmove(file->pathname, ptr,
|
||
|
|
+ sizeof(file->pathname)-(ptr-file->pathname));
|
||
|
|
+ }
|
||
|
|
spin_unlock(&mddev->lock);
|
||
|
|
|
||
|
|
if (err == 0 &&
|
||
|
|
--
|
||
|
|
cgit v0.10.2
|
||
|
|
|