linux-kernel - [tip:x86/urgent] x86, mpx: Strictly enforce empty prctl() args

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 22 Jan 2015 12:13:23 -0800
From:	tip-bot for Dave Hansen <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	dave@...1.net, dave.hansen@...ux.intel.com, luto@...capital.net,
	mingo@...nel.org, mtk.manpages@...il.com, hpa@...or.com,
	linux-kernel@...r.kernel.org, tglx@...utronix.de
Subject: [tip:x86/urgent] x86, mpx: Strictly enforce empty prctl() args

Commit-ID:  e9d1b4f3c60997fe197bf0243cb4a41a44387a88
Gitweb:     http://git.kernel.org/tip/e9d1b4f3c60997fe197bf0243cb4a41a44387a88
Author:     Dave Hansen <dave.hansen@...ux.intel.com>
AuthorDate: Thu, 8 Jan 2015 14:30:22 -0800
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Thu, 22 Jan 2015 21:11:06 +0100

x86, mpx: Strictly enforce empty prctl() args

Description from Michael Kerrisk.  He suggested an identical patch
to one I had already coded up and tested.

commit fe3d197f8431 "x86, mpx: On-demand kernel allocation of bounds
tables" added two new prctl() operations, PR_MPX_ENABLE_MANAGEMENT and
PR_MPX_DISABLE_MANAGEMENT.  However, no checks were included to ensure
that unused arguments are zero, as is done in many existing prctl()s
and as should be done for all new prctl()s. This patch adds the
required checks.

Suggested-by: Andy Lutomirski <luto@...capital.net>
Suggested-by: Michael Kerrisk <mtk.manpages@...il.com>
Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Dave Hansen <dave@...1.net>
Link: http://lkml.kernel.org/r/20150108223022.7F56FD13@viggo.jf.intel.com
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
---
 kernel/sys.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/sys.c b/kernel/sys.c
index a8c9f5a..ea9c881 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2210,9 +2210,13 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
 		up_write(&me->mm->mmap_sem);
 		break;
 	case PR_MPX_ENABLE_MANAGEMENT:
+		if (arg2 || arg3 || arg4 || arg5)
+			return -EINVAL;
 		error = MPX_ENABLE_MANAGEMENT(me);
 		break;
 	case PR_MPX_DISABLE_MANAGEMENT:
+		if (arg2 || arg3 || arg4 || arg5)
+			return -EINVAL;
 		error = MPX_DISABLE_MANAGEMENT(me);
 		break;
 	default:
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/