linux-kernel - [PATCH] vfs: respect FMODE_UNSIGNED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Jan 2014 11:57:20 +0000
From:	Nick Alcock <nick.alcock@...cle.com>
To:	Alexander Viro <viro@...iv.linux.org.uk>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] vfs: respect FMODE_UNSIGNED_OFFSET in p(read|write)[v]*().

Because the pread and pwrite functions do not respect the unsigned
offset flag, you can read certain parts of /proc/$pid/mem via lseek()
and read(), but not via pread().  (This probably went unnoticed
because on i386 and x86-64, almost everything except the vdso is
normally located below the region where signed offsets become
negative: but this is not true on all platforms.)

Fixing pwrite() is currently academic because this flag is only
used by files that do not allow writing, but it is easiest to
be consistent and retain a similarity of form between the pread*()
and pwrite*() functions.

Signed-off-by: Nick Alcock <nick.alcock@...cle.com>
---
 fs/read_write.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/fs/read_write.c b/fs/read_write.c
index 58e440d..f33f664 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -534,10 +534,12 @@ SYSCALL_DEFINE4(pread64, unsigned int, fd, char __user *, buf,
 	struct fd f;
 	ssize_t ret = -EBADF;

-	if (pos < 0)
+	f = fdget(fd);
+	if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) {
+		fdput(f);
 		return -EINVAL;
+	}

-	f = fdget(fd);
 	if (f.file) {
 		ret = -ESPIPE;
 		if (f.file->f_mode & FMODE_PREAD)
@@ -554,10 +556,12 @@ SYSCALL_DEFINE4(pwrite64, unsigned int, fd, const char __user *, buf,
 	struct fd f;
 	ssize_t ret = -EBADF;

-	if (pos < 0)
+	f = fdget(fd);
+	if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) {
+		fdput(f);
 		return -EINVAL;
+	}

-	f = fdget(fd);
 	if (f.file) {
 		ret = -ESPIPE;
 		if (f.file->f_mode & FMODE_PWRITE)  
@@ -847,10 +851,12 @@ SYSCALL_DEFINE5(preadv, unsigned long, fd, const struct iovec __user *, vec,
 	struct fd f;
 	ssize_t ret = -EBADF;

-	if (pos < 0)
+	f = fdget(fd);
+	if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) {
+		fdput(f);
 		return -EINVAL;
+	}

-	f = fdget(fd);
 	if (f.file) {
 		ret = -ESPIPE;
 		if (f.file->f_mode & FMODE_PREAD)
@@ -871,8 +877,10 @@ SYSCALL_DEFINE5(pwritev, unsigned long, fd, const struct iovec __user *, vec,
 	struct fd f;
 	ssize_t ret = -EBADF;

-	if (pos < 0)
+	if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) {
+		f = fdget(fd);
 		return -EINVAL;
+	}

 	f = fdget(fd);
 	if (f.file) {
-- 
1.8.5.2.169.ge058798
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/