From patchwork Thu Jun 1 21:24:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102191 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp624665vqr; Thu, 1 Jun 2023 14:31:40 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4qLa3gPnztaccQhdl0R/gSQTGW2+CJhVO4q7kbOIoxz+ehNmPrMNZRBW86Cik4XfGATKyz X-Received: by 2002:a05:6358:8810:b0:123:230c:c3bd with SMTP id hv16-20020a056358881000b00123230cc3bdmr8807431rwb.11.1685655100368; Thu, 01 Jun 2023 14:31:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655100; cv=none; d=google.com; s=arc-20160816; b=LrLRhmIX1OIBSIXWqyA9QP6JLLN14z/WiEjuHzvvhvJdtX2C1ejpCNCtvmDajX7CR9 wC4tr2T/eSm25F3g7NBqCxVQ/vYzbcpxybb+Dz9Muvn260lZyiX6TMjSpiwFFK8oYbCy 7jTZ+uK82YxwlzVq5jLE2troscvBrcKTcOJjwiX5pL1+0YbUIQpkXMVpfkM9xOlCpD6h Glre4FEQBUyU1ZE0hSHB18XOuy96suyhgPs+qhEuXr1YhBjfZzrTkC8OtITmdperxVvu rwL2sx1C9cURfJFc2QYWxQX6RAtFBUxf+ftqtmBeV3VT3PA8XjOkEV73Uj7qDb9nQ3AU 7+Rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=vjypfpPRoU7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=vtQa8xNi70Nc+2bFxyrp8xuaHqYWDCfKXP52pEXN02unUgmXed5PF2dXlEvB8xOPnT OS/RVE8wtgWg3JBGKv4wYrh8LoObl62hJyX71heQV/9NcZLNwFaim5KX/Ix+iMLf7Mq/ 6r/Fk8Hj77LUHAZucoKdeXastAzs3AXig9V13KKGG5kpS80abwWTAHsTyM9I/pQXUl1L QwX/mkIMfdqPRHnbuD9mFtiGMO32FLEkl+tOVnivuOnvv9/VM6wzj+UhyFx0yeOTqBkS LOSw+uSf+RukhmpF8lLDTEsBwRby9mHrtfIUT+thtozTMt5QqV+ejbBZy9byuef0biyN eEeg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=QS6kbn1l; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=WTz8zIWL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q127-20020a632a85000000b005428f25f67asi400722pgq.618.2023.06.01.14.31.23; Thu, 01 Jun 2023 14:31:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=QS6kbn1l; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=WTz8zIWL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231772AbjFAVZc (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45688 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231555AbjFAVZV (ORCPT ); Thu, 1 Jun 2023 17:25:21 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7F85184; Thu, 1 Jun 2023 14:25:20 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 51B315C01D4; Thu, 1 Jun 2023 17:25:20 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 01 Jun 2023 17:25:20 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654720; x=1685741120; bh=vjypfpPRoU 7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=QS6kbn1lVsQPDjeMFPYE/Nfixp fCec3RGDWj6Zx5E0RTWRDq9aZpHhu181d4dpYWzyYWJkyS68BUpOBwWq9DhhATO8 +ZyBhwwLPCBa+DtOU5kHp2eKiyWC2Oecwar73chh2Mtx+xjBFcKIKA2khgz1rVeV dqolwNaATMsXQ1BpanFenABNHzXkYvKkVtEwHLQvT2qi7i/TzkBlH0Du9gu8Cb6q +xHgEyKWJM55WSAp9bmt3ilgAAwWbrBWRsCW+/NnfyBKVRpzG97LN/nVzPZ3VCBA RmlCK+QFDK/qWevsJMvnWVW5MPgUVXArM3gYHEelsbECGNCROp/bQaBKBN2A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654720; x= 1685741120; bh=vjypfpPRoU7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=W Tz8zIWLRlgVtvoDLu1mw4rwdnZkCAMXL782bpRiHn9mJ1e/HL6qrZ8PEDx9FODhn 6e3xsfUl+zdXAH57zyhQkqqlEDtqt81pCD/UmXnJ/BWgtQ5vvUn6Voicq3dVGEZG RYReNPna7FeinAC4Tblf1qkgk19vioYsk02MBisIZuqiiPCiTy+Bu6/tBnlnsNym gYgHTt6CYZgEAaSfaRovs3FKiAcrd/My1ThqoCXxRmVszwtuWWhn8Y5YjyoXOhiq OPt8Ix7lDNWHhNv1gwkal4GgI/FBiSG7IauAlSD09+ap6f/XohvCXb5+oHFmBkat zB53v6zhxe+Tb+GWDW7KQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeiudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedune curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:19 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 4/6] device-mapper: Avoid double-fetch of version Date: Thu, 1 Jun 2023 17:24:53 -0400 Message-Id: <20230601212456.1533-5-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537482093037715?= X-GMAIL-MSGID: =?utf-8?q?1767537482093037715?= The version is fetched once in check_version(), which then does some validation and then overwrites the version in userspace with the API version supported by the kernel. copy_params() then fetches the version from userspace *again*, and this time no validation is done. The result is that the kernel's version number is completely controllable by userspace, provided that userspace can win a race condition. Fix this flaw by not copying the version back to the kernel the second time. This is not exploitable as the version is not further used in the kernel. However, it could become a problem if future patches start relying on the version field. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour --- drivers/md/dm-ioctl.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index da6ca26b51d0953df380582bb3a51c2ec22c27cb..fd46b249f6f856c49752063fc49d720e95df0525 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1873,12 +1873,13 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) * As well as checking the version compatibility this always * copies the kernel interface version out. */ -static int check_version(unsigned int cmd, struct dm_ioctl __user *user) +static int check_version(unsigned int cmd, struct dm_ioctl __user *user, + struct dm_ioctl *kernel_params) { - uint32_t version[3]; int r = 0; + uint32_t *version = kernel_params->version; - if (copy_from_user(version, user->version, sizeof(version))) + if (copy_from_user(version, user->version, sizeof(user->version))) return -EFAULT; if ((version[0] != DM_VERSION_MAJOR) || @@ -1922,7 +1923,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern const size_t minimum_data_size = offsetof(struct dm_ioctl, data); unsigned int noio_flag; - if (copy_from_user(param_kernel, user, minimum_data_size)) + /* Version has been copied from userspace already, avoid TOCTOU */ + if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version), + (char __user *)user + sizeof(param_kernel->version), + minimum_data_size - sizeof(param_kernel->version))) return -EFAULT; if (param_kernel->data_size < minimum_data_size) { @@ -2034,7 +2038,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us * Check the interface version passed in. This also * writes out the kernel's interface version. */ - r = check_version(cmd, user); + r = check_version(cmd, user, ¶m_kernel); if (r) return r;