From patchwork Tue Feb 27 12:31:08 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lance Richardson X-Patchwork-Id: 10245053 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3336560211 for ; Tue, 27 Feb 2018 12:31:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1C3252889C for ; Tue, 27 Feb 2018 12:31:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0EDC62889E; Tue, 27 Feb 2018 12:31:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7E6652889C for ; Tue, 27 Feb 2018 12:31:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752130AbeB0MbL (ORCPT ); Tue, 27 Feb 2018 07:31:11 -0500 Received: from mail-qt0-f194.google.com ([209.85.216.194]:44600 "EHLO mail-qt0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752012AbeB0MbK (ORCPT ); Tue, 27 Feb 2018 07:31:10 -0500 Received: by mail-qt0-f194.google.com with SMTP id g60so22845442qtd.11 for ; Tue, 27 Feb 2018 04:31:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id; bh=oH/AG7e78Xkzda4R6fHA/Iby83mA1G9caM7qmrkdHuc=; b=cPEOLx8wn4gb6l/qK/yVFwYEA1hGu8sI/3YXHPV0hcNNbRbUrwVZ0WWQacSrMVLeeT GB8kyItGID791MC6m0vdU6MQer3KCftgs0aC4Vbd7ESiL+WMkzOE2iNBGDRv34B1oGWw 6H7rXO38rqBbTJZ7Fq+wmEhTOt9AXDfBV9YTcrvwzdykK/uiQ0pCm8HuIPIBeavauV9H PECKyOzLfMYjrLn8udoJ97GpfddpTYjUqWxNWbrzb6AEJWRi7vCCG4pHbJLqi0wCTsUy s7yYihy8Wlr8y5kCu+wf9u0Q//Q1beSElI2j3YKpaF9B7FK77l7KdKaqUx4lv+Buypk3 lUFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=oH/AG7e78Xkzda4R6fHA/Iby83mA1G9caM7qmrkdHuc=; b=QUoqzcpYbgMNzXRlYjvOACYEXoIn4Go0d9oRd6hVji1ZIegPhy5V1vmhap2y1O7i1n whjgFUaOUhCEdnqQlIEEc9qACRQunrGLmrtnRX5LuAOY4J/OyNAeiABWrzl96QO6x0Yh sLz0hoPBkCMG5UGRnYXAYyOczUoBpuH+kZfhE7KTn2n+FiZWe2JRHSW8b0GhTx+lKcm1 Tr6rGX+pb4oeEvkiygwBMGiAgUAsYLotisOTqs5oQjE99+MipWgFp8nKrky5WOI83x+W /qhAfZTrxpxlz3VPf3hbhxcpMSb36+cyQAzrdVTJABeYm032b6UW3/be8HRpoyZciwzT rT3g== X-Gm-Message-State: APf1xPDh6KaDHnTei69EoX464AmfjQzfzp1rvQ8Xni+iWcTTRyB5xCor 93r1nJPINdz86Ib2u3B2aeY= X-Google-Smtp-Source: AG47ELuJthqN7UOzIdOCXfOyL5o+lzzysxCG4jePGg7s+jbe/ArSHU5XaLarC5+wnza7Ttsxw4C6/g== X-Received: by 10.200.49.130 with SMTP id h2mr24063671qte.281.1519734669543; Tue, 27 Feb 2018 04:31:09 -0800 (PST) Received: from Corsair.corp.extremenetworks.com (cpe-2606-A000-112A-C184-D8EA-C2C6-ED97-896E.dyn6.twc.com. [2606:a000:112a:c184:d8ea:c2c6:ed97:896e]) by smtp.gmail.com with ESMTPSA id x30sm203249qtm.13.2018.02.27.04.31.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Feb 2018 04:31:09 -0800 (PST) From: Lance Richardson To: viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org, lance.richardson.net@gmail.com, mingo@redhat.com Subject: [PATCH] fs: select/pselect buffer overrun with x32 abi Date: Tue, 27 Feb 2018 07:31:08 -0500 Message-Id: <20180227123108.15637-1-lance.richardson.net@gmail.com> X-Mailer: git-send-email 2.14.1 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The definition of fd_set in X32 user-space uses a 32-bit base data type for the fd array while the kernel uses a 64-bit base data type. For applications using the glibc implementation of select(2)/pselect(2), the size of fd_set is an integer multiple of both base types, so there is no issue. For applications using fd_set sizes that are different from the glibc default size, an overrun of the user-space fd_set buffer will occur when the user-space buffer size is an odd multiple of 4 bytes (e.g. user-space can pass a 12-byte fd_set to the kernel and the kernel will copy 16 bytes to user-space before returning from select/pselect system calls). OpenSSH is one example of an application using fd_set sizes different from the default. Reproducer (compiled with gcc -mx32): #include #include #include #include #define howmany(x, y) (((x) + (y) - 1) / (y)) int test(int nfds) { fd_set *fds; struct timeval tv = {0, 0}; printf("Calling select with nfds = %d\n", nfds); fds = calloc(howmany(nfds, __NFDBITS), sizeof(__fd_mask)); select(nfds, fds, NULL, NULL, &tv); free(fds); printf("Success\n"); return 0; } int main(int argc, char **argv) { mcheck_pedantic(NULL); test(64); test(65); return 0; } /* Expected output without this patch: * * Calling select with nfds = 64 * Success * Calling select with nfds = 65 * memory clobbered past end of allocated block * Aborted (core dumped) */ Signed-off-by: Lance Richardson --- fs/select.c | 78 +++++++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 53 insertions(+), 25 deletions(-) diff --git a/fs/select.c b/fs/select.c index b6c36254028a..280176fff5e8 100644 --- a/fs/select.c +++ b/fs/select.c @@ -384,6 +384,31 @@ void zero_fd_set(unsigned long nr, unsigned long *fdset) memset(fdset, 0, FDS_BYTES(nr)); } +/* + * Ooo, nasty. We need here to frob 32-bit unsigned longs to + * 64-bit unsigned longs. + */ +static +int compat_get_fd_set(unsigned long nr, compat_ulong_t __user *ufdset, + unsigned long *fdset) +{ + if (ufdset) { + return compat_get_bitmap(fdset, ufdset, nr); + } else { + zero_fd_set(nr, fdset); + return 0; + } +} + +static +int compat_set_fd_set(unsigned long nr, compat_ulong_t __user *ufdset, + unsigned long *fdset) +{ + if (!ufdset) + return 0; + return compat_put_bitmap(ufdset, fdset, nr); +} + #define FDS_IN(fds, n) (fds->in + n) #define FDS_OUT(fds, n) (fds->out + n) #define FDS_EX(fds, n) (fds->ex + n) @@ -644,10 +669,24 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp, fds.res_out = bits + 4*size; fds.res_ex = bits + 5*size; +#if defined(CONFIG_X86_X32) + if (test_thread_flag(TIF_X32)) { + if ((ret = compat_get_fd_set(n, (compat_ulong_t __user *)inp, fds.in)) || + (ret = compat_get_fd_set(n, (compat_ulong_t __user *)outp, fds.out)) || + (ret = compat_get_fd_set(n, (compat_ulong_t __user *)exp, fds.ex))) + goto out; + } else { + if ((ret = get_fd_set(n, inp, fds.in)) || + (ret = get_fd_set(n, outp, fds.out)) || + (ret = get_fd_set(n, exp, fds.ex))) + goto out; + } +#else if ((ret = get_fd_set(n, inp, fds.in)) || (ret = get_fd_set(n, outp, fds.out)) || (ret = get_fd_set(n, exp, fds.ex))) goto out; +#endif zero_fd_set(n, fds.res_in); zero_fd_set(n, fds.res_out); zero_fd_set(n, fds.res_ex); @@ -663,10 +702,24 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp, ret = 0; } +#if defined(CONFIG_X86_X32) + if (test_thread_flag(TIF_X32)) { + if ((ret = compat_set_fd_set(n, (compat_ulong_t __user *)inp, fds.res_in)) || + (ret = compat_set_fd_set(n, (compat_ulong_t __user *)outp, fds.res_out)) || + (ret = compat_set_fd_set(n, (compat_ulong_t __user *)exp, fds.res_ex))) + ret = -EFAULT; + } else { + if (set_fd_set(n, inp, fds.res_in) || + set_fd_set(n, outp, fds.res_out) || + set_fd_set(n, exp, fds.res_ex)) + ret = -EFAULT; + } +#else if (set_fd_set(n, inp, fds.res_in) || set_fd_set(n, outp, fds.res_out) || set_fd_set(n, exp, fds.res_ex)) ret = -EFAULT; +#endif out: if (bits != stack_fds) @@ -1149,31 +1202,6 @@ int compat_poll_select_copy_remaining(struct timespec64 *end_time, void __user * return ret; } -/* - * Ooo, nasty. We need here to frob 32-bit unsigned longs to - * 64-bit unsigned longs. - */ -static -int compat_get_fd_set(unsigned long nr, compat_ulong_t __user *ufdset, - unsigned long *fdset) -{ - if (ufdset) { - return compat_get_bitmap(fdset, ufdset, nr); - } else { - zero_fd_set(nr, fdset); - return 0; - } -} - -static -int compat_set_fd_set(unsigned long nr, compat_ulong_t __user *ufdset, - unsigned long *fdset) -{ - if (!ufdset) - return 0; - return compat_put_bitmap(ufdset, fdset, nr); -} - /* * This is a virtual copy of sys_select from fs/select.c and probably