linux-kernel - Re: [PATCH] Harden autofs ioctl table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 20 Aug 2020 13:11:11 +0800
From:   Ian Kent <raven@...maw.net>
To:     Matthew Wilcox <willy@...radead.org>, autofs@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] Harden autofs ioctl table

On Tue, 2020-08-18 at 13:22 +0100, Matthew Wilcox wrote:
> The table of ioctl functions should be marked const in order to put
> them
> in read-only memory, and we should use array_index_nospec() to avoid
> speculation disclosing the contents of kernel memory to userspace.
> 
> Signed-off-by: Matthew Wilcox (Oracle) <willy@...radead.org>

Acked-by: Ian Kent <raven@...maw.net>

Thanks Matthew, I certainly want to know about changes to autofs
made by others so thanks for sending this to me.

At the same time I need to send my patches via someone else as
Linus asked me to do ages ago now.

So, once again Andrew, if you would be so kind as to include this
in your tree please.

Ian

> 
> diff --git a/fs/autofs/dev-ioctl.c b/fs/autofs/dev-ioctl.c
> index 75105f45c51a..322b7dfb4ea0 100644
> --- a/fs/autofs/dev-ioctl.c
> +++ b/fs/autofs/dev-ioctl.c
> @@ -8,6 +8,7 @@
>  #include <linux/compat.h>
>  #include <linux/syscalls.h>
>  #include <linux/magic.h>
> +#include <linux/nospec.h>
>  
>  #include "autofs_i.h"
>  
> @@ -563,7 +564,7 @@ static int autofs_dev_ioctl_ismountpoint(struct
> file *fp,
>  
>  static ioctl_fn lookup_dev_ioctl(unsigned int cmd)
>  {
> -	static ioctl_fn _ioctls[] = {
> +	static const ioctl_fn _ioctls[] = {
>  		autofs_dev_ioctl_version,
>  		autofs_dev_ioctl_protover,
>  		autofs_dev_ioctl_protosubver,
> @@ -581,7 +582,10 @@ static ioctl_fn lookup_dev_ioctl(unsigned int
> cmd)
>  	};
>  	unsigned int idx = cmd_idx(cmd);
>  
> -	return (idx >= ARRAY_SIZE(_ioctls)) ? NULL : _ioctls[idx];
> +	if (idx >= ARRAY_SIZE(_ioctls))
> +		return NULL;
> +	idx = array_index_nospec(idx, ARRAY_SIZE(_ioctls));
> +	return _ioctls[idx];
>  }
>  
>  /* ioctl dispatcher */