linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00

James Hogan 641ddffc6f metag/uaccess: Check access_ok in strncpy_from_user commit `3a158a62da` upstream. The metag implementation of strncpy_from_user() doesn't validate the src pointer, which could allow reading of arbitrary kernel memory. Add a short access_ok() check to prevent that. Its still possible for it to read across the user/kernel boundary, but it will invariably reach a NUL character after only 9 bytes, leaking only a static kernel address being loaded into D0Re0 at the beginning of __start, which is acceptable for the immediate fix. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Signed-off-by: Ben Hutchings <ben@decadent.org.uk>	History 2017-08-26 02:14:45 +01:00
..
asm	metag/uaccess: Check access_ok in strncpy_from_user	2017-08-26 02:14:45 +01:00
uapi/asm	metag: Remove _STK_LIM_MAX override	2014-05-15 00:30:32 +01:00

James Hogan 641ddffc6f metag/uaccess: Check access_ok in strncpy_from_user

commit 3a158a62da upstream.

The metag implementation of strncpy_from_user() doesn't validate the src
pointer, which could allow reading of arbitrary kernel memory. Add a
short access_ok() check to prevent that.

Its still possible for it to read across the user/kernel boundary, but
it will invariably reach a NUL character after only 9 bytes, leaking
only a static kernel address being loaded into D0Re0 at the beginning of
__start, which is acceptable for the immediate fix.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

History

2017-08-26 02:14:45 +01:00

asm metag/uaccess: Check access_ok in strncpy_from_user 2017-08-26 02:14:45 +01:00

uapi/asm metag: Remove _STK_LIM_MAX override 2014-05-15 00:30:32 +01:00