kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/block
History
Andy Whitcroft 3141e07502 floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl 
commit 65eea8edc3 upstream.

The final field of a floppy_struct is the field "name", which is a pointer
to a string in kernel memory.  The kernel pointer should not be copied to
user memory.  The FDGETPRM ioctl copies a floppy_struct to user memory,
including this "name" field.  This pointer cannot be used by the user
and it will leak a kernel address to user-space, which will reveal the
location of kernel code and data and undermine KASLR protection.

Model this code after the compat ioctl which copies the returned data
to a previously cleared temporary structure on the stack (excluding the
name pointer) and copy out to userspace from there.  As we already have
an inparam union with an appropriate member and that memory is already
cleared even for read only calls make use of that as a temporary store.

Based on an initial patch by Brian Belleville.

CVE-2018-7755
Signed-off-by: Andy Whitcroft <apw@canonical.com>

Broke up long line.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-10-03 04:10:08 +01:00
..
aoe mm: close PageTail race 2014-03-04 07:55:47 -08:00
drbd drbd: avoid redefinition of BITS_PER_PAGE 2017-11-11 13:34:02 +00:00
mtip32xx mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild 2016-05-01 00:05:53 +02:00
paride paride: fix the "verbose" module param 2017-11-11 13:33:50 +00:00
rsxx block: Convert bio_for_each_segment() to bvec_iter 2013-11-23 22:33:49 -08:00
xen-blkback xen-blkback: don't leak stack data via response ring 2017-07-18 18:40:40 +01:00
zram zram: do not use copy_page with non-page aligned address 2017-07-18 18:40:35 +01:00
amiflop.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
ataflop.c Merge branch 'for-3.16/core' of git://git.kernel.dk/linux-block into next 2014-06-02 09:29:34 -07:00
brd.c brd: return -ENOSPC rather than -ENOMEM on page allocation failure 2014-06-04 16:54:02 -07:00
cciss.c cciss: Use pci_enable_msix_exact() instead of pci_enable_msix() 2014-04-21 19:02:08 -06:00
cciss.h cciss: Adds simple mode functionality 2011-08-08 11:40:15 +02:00
cciss_cmd.h cciss: use new doorbell-bit-5 reset method 2011-05-06 08:23:55 -06:00
cciss_scsi.c cciss: switch to ->show_info() 2013-04-09 14:13:19 -04:00
cciss_scsi.h cciss: add cciss_tape_cmds module paramter 2011-05-06 08:23:59 -06:00
cpqarray.c cpqarray: fix info leak in ida_locked_ioctl() 2013-09-24 17:00:26 -07:00
cpqarray.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cryptoloop.c move linux/loop.h to drivers/block 2013-06-29 12:46:45 +04:00
DAC960.c DAC960: remove sleep_on usage 2014-03-13 14:56:38 -06:00
DAC960.h Fix DAC960 driver on machines which don't support 64-bit DMA 2007-09-11 17:21:19 -07:00
floppy.c floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl 2018-10-03 04:10:08 +01:00
hd.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
ida_cmd.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ida_ioctl.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Kconfig zram: promote zram from staging 2014-01-30 16:56:55 -08:00
loop.c Merge branch 'sched/urgent' into sched/core, to avoid conflicts 2014-05-07 13:15:46 +02:00
loop.h move linux/loop.h to drivers/block 2013-06-29 12:46:45 +04:00
Makefile zram: promote zram from staging 2014-01-30 16:56:55 -08:00
mg_disk.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
nbd.c nbd: only set MSG_MORE when we have more to send 2017-03-16 02:27:03 +00:00
null_blk.c null_blk: fix softirq completions for queue_mode == 1 2014-06-16 11:40:25 -06:00
nvme-core.c nvme/pci: Don't free queues on error 2017-02-23 03:54:35 +00:00
nvme-scsi.c NVMe: Fix START_STOP_UNIT Scsi->NVMe translation. 2014-06-13 13:11:00 -04:00
osdblk.c block: replace strict_strtoul() with kstrtoul() 2013-09-11 15:56:56 -07:00
pktcdvd.c pktcdvd: Fix pkt_setup_dev() error path 2018-06-16 22:21:46 +01:00
ps3disk.c block: Kill bio_segments()/bi_vcnt usage 2013-11-23 22:33:51 -08:00
ps3vram.c block: Convert bio_for_each_segment() to bvec_iter 2013-11-23 22:33:49 -08:00
rbd.c rbd: whitelist RBD_FEATURE_OPERATIONS feature bit 2018-06-16 22:22:02 +01:00
rbd_types.h rbd: get rid of RBD_MAX_SEG_NAME_LEN 2012-12-17 08:37:29 -06:00
skd_main.c skd: Submit requests to firmware before triggering the doorbell 2017-11-26 13:50:21 +00:00
skd_s1120.h skd: fix formatting in skd_s1120.h 2013-11-08 09:10:30 -07:00
smart1,2.h fix typos 'comamnd' -> 'command' in comments 2011-02-02 11:31:21 +01:00
sunvdc.c sunvdc: don't call VD_OP_GET_VTOC 2014-11-27 11:21:59 +00:00
swim.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
swim3.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
swim_asm.S m68k: mac - Add SWIM floppy support 2009-03-26 21:15:27 +01:00
sx8.c drivers/block/sx8.c: remove unnecessary pci_set_drvdata() 2014-01-21 20:16:56 -08:00
umem.c block: Convert drivers to immutable biovecs 2013-11-23 22:33:51 -08:00
umem.h drivers/block/umem: trim trailing whitespace 2007-10-10 09:25:59 +02:00
virtio_blk.c Merge branch 'for-3.16/core' of git://git.kernel.dk/linux-block into next 2014-06-02 09:29:34 -07:00
xen-blkfront.c xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) 2015-11-16 11:26:58 +00:00
xsysace.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
z2ram.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00