From patchwork Sun May 6 05:48:14 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wenwen Wang X-Patchwork-Id: 10382557 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BD8F760159 for ; Sun, 6 May 2018 05:48:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A283F28E87 for ; Sun, 6 May 2018 05:48:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8242028E91; Sun, 6 May 2018 05:48:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0032728E87 for ; Sun, 6 May 2018 05:48:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750981AbeEFFss (ORCPT ); Sun, 6 May 2018 01:48:48 -0400 Received: from mta-p5.oit.umn.edu ([134.84.196.205]:49258 "EHLO mta-p5.oit.umn.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750824AbeEFFsr (ORCPT ); Sun, 6 May 2018 01:48:47 -0400 Received: from localhost (unknown [127.0.0.1]) by mta-p5.oit.umn.edu (Postfix) with ESMTP id 8B93FA42 for ; Sun, 6 May 2018 05:48:46 +0000 (UTC) X-Virus-Scanned: amavisd-new at umn.edu Received: from mta-p5.oit.umn.edu ([127.0.0.1]) by localhost (mta-p5.oit.umn.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a5PUCCt8EK44 for ; Sun, 6 May 2018 00:48:46 -0500 (CDT) Received: from mail-io0-f197.google.com (mail-io0-f197.google.com [209.85.223.197]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta-p5.oit.umn.edu (Postfix) with ESMTPS id 5F253707 for ; Sun, 6 May 2018 00:48:46 -0500 (CDT) Received: by mail-io0-f197.google.com with SMTP id s2-v6so16639871ioa.22 for ; Sat, 05 May 2018 22:48:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umn.edu; s=google; h=from:to:cc:subject:date:message-id; bh=7qjD/SBuYyW9/mV0kxNTk1QOyc4GW3/Pxg6d0LWL+to=; b=GPR2z02U63j3sX7PiozVlOb6cBtSvLuk59vswlXmsPv81f+nYyZRyaW3UDNCovYmhn x0i2IEwsi983MPpFpq9nLJs1DLCK/e9iVUvw1QyGT0lV9UUFxwYpatalRCJhBc4Lsf0Q /YD1Y87Xaev4WkZDndffi4izVK2B675UG/4rS1ppAa6+ciNf6J0/8uRsaLEmnBEGt9Pt l8ggkjKqCiSxr0OK8UuviVBQl1RJi/0tXLcoNqmjHmA8WPCoktzfvqAlEMs9mJWXPtrj uj/zsZLaWcAI2qdVziX0Y0273XxhHvQT/ZM+Mx7s/tsTCUmnDgHj+Mvpb2A4Qm7codgF UIOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=7qjD/SBuYyW9/mV0kxNTk1QOyc4GW3/Pxg6d0LWL+to=; b=RgjXp0f5wFIod2jSEH0dsWVqqXItco6isG4qK6Z6t3bcivPWmkR3N9LzwT4U6g4SvR CcMgGTgVzzvfwLwzmTyZJQPZ0eHLs4gXzTV8UpOeI3jfdYA2lhQha5eK50vGP9SgSXjf Eta0zr2oZyQIpaB8VTSrcBJXjSGMvXFOLLkpSlIn1YX0GIMp2tN3kq65+J4nzqvsNLSO qWWdawGShdHXMvGi1iYJaqRfjX31l57wJF3rBi6Iq+UgaaSDNl0sgnFIDMQUaPaSLvrW yEI0p99vElyJytW0AbfCXXAFLr/eTg5aorNUsVtepWxlyUt2KqI/4Jc4n9CEe/t/Erpr 6dlA== X-Gm-Message-State: ALQs6tBpg/LHYs0DvFLbg0b9EhdLiYPlQtB1gAMKt9NjAHxzH/jIA+s2 75dEtCUPszedXnxd3xUp0risqAVIvX1I+lEVpnVTW/ZK34Ox0fbdTgjL7glc/VieLq9CgC4Ms8O LolgPxny6ol2sGLWiSoYdSlfT/A== X-Received: by 2002:a6b:2a05:: with SMTP id q5-v6mr36391475ioq.252.1525585726040; Sat, 05 May 2018 22:48:46 -0700 (PDT) X-Google-Smtp-Source: AB8JxZoSG6cKMMW9fp9Cv7JCWv+9c7bfz24fL8kkLyXhFX0BJhV93fq0uLX2LupUFpnf5vb8KEnM7A== X-Received: by 2002:a6b:2a05:: with SMTP id q5-v6mr36391469ioq.252.1525585725824; Sat, 05 May 2018 22:48:45 -0700 (PDT) Received: from cs-u-cslp16.cs.umn.edu (cs-u-cslp16.cs.umn.edu. [134.84.121.95]) by smtp.gmail.com with ESMTPSA id 2-v6sm2903997itk.1.2018.05.05.22.48.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 05 May 2018 22:48:44 -0700 (PDT) From: Wenwen Wang To: Wenwen Wang Cc: Kangjie Lu , Adam Radford , "James E.J. Bottomley" , "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org (open list) Subject: [PATCH] scsi: 3w-xxxx: fix a missing-check bug Date: Sun, 6 May 2018 00:48:14 -0500 Message-Id: <1525585714-17548-1-git-send-email-wang6495@umn.edu> X-Mailer: git-send-email 2.7.4 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In tw_chrdev_ioctl(), the length of the data buffer is firstly copied from the userspace pointer 'argp' and saved to the kernel object 'data_buffer_length'. Then a security check is performed on it to make sure that the length is not more than 'TW_MAX_IOCTL_SECTORS * 512'. Otherwise, an error code -EINVAL is returned. If the security check is passed, the entire ioctl command is copied again from the 'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various operations are performed on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer resides in userspace, a malicious userspace process can race to change the buffer length between the two copies. This way, the user can bypass the security check and inject invalid data buffer length. This can cause potential security issues in the following execution. This patch checks the buffer length obtained in the second copy. An error code -EINVAL will be returned if it is not same as the original one in the first copy. Signed-off-by: Wenwen Wang --- drivers/scsi/3w-xxxx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c index 33261b6..ef79194 100644 --- a/drivers/scsi/3w-xxxx.c +++ b/drivers/scsi/3w-xxxx.c @@ -919,6 +919,10 @@ static long tw_chrdev_ioctl(struct file *file, unsigned int cmd, unsigned long a /* Now copy down the entire ioctl */ if (copy_from_user(tw_ioctl, argp, data_buffer_length + sizeof(TW_New_Ioctl) - 1)) goto out2; + if (tw_ioctl->data_buffer_length != data_buffer_length) { + retval = -EINVAL; + goto out2; + } passthru = (TW_Passthru *)&tw_ioctl->firmware_command;