linux-kernel - [PATCH] drm: never write to the userspace more data than the caller wants

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Oct 2013 20:12:35 -0400
From:	Pavel Roskin <proski@....org>
To:	Dave Airlie <airlied@...hat.com>, linux-kernel@...r.kernel.org,
	dri-devel@...ts.freedesktop.org,
	Chris Wilson <chris@...is-wilson.co.uk>
Subject: [PATCH] drm: never write to the userspace more data than the caller
 wants

The amount of data wanted by the userspace caller is encoded in the
ioctl number.  Generic drm ioctls were ignoring it.

As a result, Intel Xorg driver didn't work for i386 userspace on x86_64
kernel on some systems.  sizeof(struct drm_mode_get_connector) is 76
bytes on i686 and 80 bytes on x86_64 due to the tail alignment (the data
positions match).  The userspace was using the 4 bytes after the
structure to hold the result of the ioctl.  Since drm_ioctl() was
copying 80 bytes instead of 76, it was clobbering that data.

A workaround has been committed to xf86-video-intel.

Signed-off-by: Pavel Roskin <proski@....org>
Cc: stable@...r.kernel.org
---
 drivers/gpu/drm/drm_drv.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd2..8a1c721 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -403,8 +403,11 @@ long drm_ioctl(struct file *filp,
 	}
 	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
 		ioctl = &drm_ioctls[nr];
+		usize = _IOC_SIZE(cmd);
 		cmd = ioctl->cmd;
-		usize = asize = _IOC_SIZE(cmd);
+		asize = _IOC_SIZE(cmd);
+		if (unlikely(usize > asize))
+			usize = asize;
 	} else
 		goto err_i1;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/