From patchwork Wed Sep 20 04:08:52 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Meng Xu X-Patchwork-Id: 9960667 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 22D2C60208 for ; Wed, 20 Sep 2017 04:09:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 114E620001 for ; Wed, 20 Sep 2017 04:09:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 04E0128F8A; Wed, 20 Sep 2017 04:09:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, FREEMAIL_FROM,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BC9A620001 for ; Wed, 20 Sep 2017 04:09:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751009AbdITEJb (ORCPT ); Wed, 20 Sep 2017 00:09:31 -0400 Received: from mx2.gtisc.gatech.edu ([143.215.130.82]:41780 "EHLO mx2.gtisc.gatech.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750785AbdITEJb (ORCPT ); Wed, 20 Sep 2017 00:09:31 -0400 Received: from bombshell.gtisc.gatech.edu (unknown [172.30.240.76]) by mx2.gtisc.gatech.edu (Postfix) with SMTP id 2E00C1BC252; Wed, 20 Sep 2017 04:09:24 +0000 (UTC) Received: (nullmailer pid 25937 invoked by uid 1026); Wed, 20 Sep 2017 04:09:24 -0000 From: Meng Xu To: aacraid@microsemi.com, jejb@linux.vnet.ibm.com, martin.petersen@oracle.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Meng Xu Subject: [PATCH] aacraid: fix potential double-fetch issue Date: Wed, 20 Sep 2017 00:08:52 -0400 Message-Id: <1505880532-25847-1-git-send-email-mengxu.gatech@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP While examining the kernel source code, I found a dangerous operation that could turn into a double-fetch situation (a race condition bug) where the same userspace memory region are fetched twice into kernel with sanity checks after the first fetch while missing checks after the second fetch. 1. The first userspace fetch happens in copy_from_user(&fibsize, &user_srb->count,sizeof(u32)) 2. Subsequently fibsize undergoes a few sanity checks and is then used to allocate user_srbcmd = kmalloc(fibsize, GFP_KERNEL). 3. The second userspace fetch happens in copy_from_user(user_srbcmd, user_srb,fibsize) 4. Given that the memory region pointed by user_srb can be fully controlled in userspace, an attacker can race to override the user_srb->count to arbitrary value (say 0XFFFFFFFF) after the first fetch but before the second. The changed value will be copied to user_srbcmd. The patch explicitly overrides user_srbcmd->count after the second userspace fetch with the value fibsize from the first userspace fetch. In this way, it is assured that the relation, user_srbcmd->count stores the size of the user_srbcmd buffer, still holds after the second fetch. Signed-off-by: Meng Xu --- drivers/scsi/aacraid/commctrl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index 9ab0fa9..734bf11 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -540,6 +540,12 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) goto cleanup; } + /* + * re-establish the relation that user_srbcmd->count holds the + * size of user_srbcmd + */ + user_srbcmd->count = fibsize; + flags = user_srbcmd->flags; /* from user in cpu order */ switch (flags & (SRB_DataIn | SRB_DataOut)) { case SRB_DataOut: