linux-kernel - [PATCH] fs/select: Fix kernel panic due to memory corruption in compat_get_fd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 22 Aug 2017 21:01:37 +0200
From:   Helge Deller <deller@....de>
To:     Helge Deller <deller@....de>
Cc:     Al Viro <viro@...iv.linux.org.uk>, linux-fsdevel@...r.kernel.org,
        John David Anglin <dave.anglin@...l.net>,
        linux-kernel@...r.kernel.org,
        linux-parisc List <linux-parisc@...r.kernel.org>
Subject: [PATCH] fs/select: Fix kernel panic due to memory corruption in
 compat_get_fd_set()

Dave, can you test this patch?
Helge

------
[PATCH] Fix kernel panic due to memory corruption in compat_get_fd_set()

Dave faced this kernel crash in the select() compat syscall on the
parisc architecture:

 Kernel Fault: Code=26 (Data memory access rights trap) regs=00000002234b84e0 (Addr=0000000000000000)
 CPU: 1 PID: 21167 Comm: polyimport Not tainted 4.13.0-rc5+ #1
 task: 0000000223d74b50 task.stack: 00000002234b8000
 IAOQ[0]: memset+0x68/0xd8
 IAOQ[1]: memset+0x6c/0xd8
 RP(r2): compat_get_fd_set+0x5c/0x78
 Backtrace:
 [<00000000402f316c>] compat_get_fd_set+0x5c/0x78
 [<00000000402f3cac>] compat_core_sys_select+0x1cc/0x300
 [<00000000402f52dc>] compat_SyS_select+0x144/0x1a0
 [<0000000040155fe4>] syscall_exit+0x0/0x14
 Kernel panic - not syncing: Kernel Fault

It seems commit 464d62421cb8 ("select: switch compat_{get,put}_fd_set()
to compat_{get,put}_bitmap()") broke the calculation on how many bytes
need to be zeroed in case of fdset beeing NULL. This leads to memory
overwrites and crashes.

Fixes: 464d62421cb8 ("select: switch compat_{get,put}_fd_set() to compat_{get,put}_bitmap()"
Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: linux-fsdevel@...r.kernel.org
Signed-off-by: Helge Deller <deller@....de>

diff --git a/fs/select.c b/fs/select.c
index 9d5f15e..c6362e3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -1164,11 +1164,7 @@ int compat_get_fd_set(unsigned long nr, compat_ulong_t __user *ufdset,
 	if (ufdset) {
 		return compat_get_bitmap(fdset, ufdset, nr);
 	} else {
-		/* Tricky, must clear full unsigned long in the
-		 * kernel fdset at the end, ALIGN makes sure that
-		 * actually happens.
-		 */
-		memset(fdset, 0, ALIGN(nr, BITS_PER_LONG));
+		zero_fd_set(nr, fdset);
 		return 0;
 	}
 }