linux-kernel - [PATCH 4.9 33/94] staging: android: ashmem: Fix mmap size validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181002132502.765038726@linuxfoundation.org>
Date:   Tue,  2 Oct 2018 06:24:47 -0700
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Todd Kjos <tkjos@...roid.com>,
        devel@...verdev.osuosl.org, kernel-team@...roid.com,
        Joel Fernandes <joel@...lfernandes.org>,
        Alistair Strachan <astrachan@...gle.com>,
        Martijn Coenen <maco@...roid.com>,
        Sasha Levin <alexander.levin@...rosoft.com>
Subject: [PATCH 4.9 33/94] staging: android: ashmem: Fix mmap size validation

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alistair Strachan <astrachan@...gle.com>

[ Upstream commit 8632c614565d0c5fdde527889601c018e97b6384 ]

The ashmem driver did not check that the size/offset of the vma passed
to its .mmap() function was not larger than the ashmem object being
mapped. This could cause mmap() to succeed, even though accessing parts
of the mapping would later fail with a segmentation fault.

Ensure an error is returned by the ashmem_mmap() function if the vma
size is larger than the ashmem object size. This enables safer handling
of the problem in userspace.

Cc: Todd Kjos <tkjos@...roid.com>
Cc: devel@...verdev.osuosl.org
Cc: linux-kernel@...r.kernel.org
Cc: kernel-team@...roid.com
Cc: Joel Fernandes <joel@...lfernandes.org>
Signed-off-by: Alistair Strachan <astrachan@...gle.com>
Acked-by: Joel Fernandes (Google) <joel@...lfernandes.org>
Reviewed-by: Martijn Coenen <maco@...roid.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@...rosoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 drivers/staging/android/ashmem.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file
 		goto out;
 	}
 
+	/* requested mapping size larger than object size */
+	if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/* requested protection bits must match our allowed protection mask */
 	if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
 		     calc_vm_prot_bits(PROT_MASK, 0))) {