3ddc5b46a8
I found the following pattern that leads in to interesting findings: grep -r "ret.*|=.*__put_user" * grep -r "ret.*|=.*__get_user" * grep -r "ret.*|=.*__copy" * The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat, since those appear in compat code, we could probably expect the kernel addresses not to be reachable in the lower 32-bit range, so I think they might not be exploitable. For the "__get_user" cases, I don't think those are exploitable: the worse that can happen is that the kernel will copy kernel memory into in-kernel buffers, and will fail immediately afterward. The alpha csum_partial_copy_from_user() seems to be missing the access_ok() check entirely. The fix is inspired from x86. This could lead to information leak on alpha. I also noticed that many architectures map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I wonder if the latter is performing the access checks on every architectures. Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| callback_srm.S | ||
| checksum.c | ||
| clear_page.S | ||
| clear_user.S | ||
| copy_page.S | ||
| copy_user.S | ||
| csum_ipv6_magic.S | ||
| csum_partial_copy.c | ||
| dbg_current.S | ||
| dbg_stackcheck.S | ||
| dbg_stackkill.S | ||
| dec_and_lock.c | ||
| divide.S | ||
| ev6-clear_page.S | ||
| ev6-clear_user.S | ||
| ev6-copy_page.S | ||
| ev6-copy_user.S | ||
| ev6-csum_ipv6_magic.S | ||
| ev6-divide.S | ||
| ev6-memchr.S | ||
| ev6-memcpy.S | ||
| ev6-memset.S | ||
| ev6-stxcpy.S | ||
| ev6-stxncpy.S | ||
| ev67-strcat.S | ||
| ev67-strchr.S | ||
| ev67-strlen.S | ||
| ev67-strncat.S | ||
| ev67-strrchr.S | ||
| fls.c | ||
| fpreg.c | ||
| memchr.S | ||
| memcpy.c | ||
| memmove.S | ||
| memset.S | ||
| srm_printk.c | ||
| srm_puts.c | ||
| stacktrace.c | ||
| strcat.S | ||
| strchr.S | ||
| strcpy.S | ||
| strlen.S | ||
| strncat.S | ||
| strncpy.S | ||
| strrchr.S | ||
| stxcpy.S | ||
| stxncpy.S | ||
| udelay.c | ||