From patchwork Tue May 8 00:54:01 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wenwen Wang X-Patchwork-Id: 10385015 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B714560236 for ; Tue, 8 May 2018 00:54:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ADECC28B53 for ; Tue, 8 May 2018 00:54:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9E0A828BD4; Tue, 8 May 2018 00:54:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 43B0628B53 for ; Tue, 8 May 2018 00:54:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753457AbeEHAyW (ORCPT ); Mon, 7 May 2018 20:54:22 -0400 Received: from mta-p6.oit.umn.edu ([134.84.196.206]:43332 "EHLO mta-p6.oit.umn.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753108AbeEHAyV (ORCPT ); Mon, 7 May 2018 20:54:21 -0400 Received: from localhost (unknown [127.0.0.1]) by mta-p6.oit.umn.edu (Postfix) with ESMTP id CEAB9BA3 for ; Tue, 8 May 2018 00:54:20 +0000 (UTC) X-Virus-Scanned: amavisd-new at umn.edu Received: from mta-p6.oit.umn.edu ([127.0.0.1]) by localhost (mta-p6.oit.umn.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8LoWbXsoJ9oI for ; Mon, 7 May 2018 19:54:20 -0500 (CDT) Received: from mail-it0-f72.google.com (mail-it0-f72.google.com [209.85.214.72]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta-p6.oit.umn.edu (Postfix) with ESMTPS id A56C2BA2 for ; Mon, 7 May 2018 19:54:20 -0500 (CDT) Received: by mail-it0-f72.google.com with SMTP id e22-v6so10691429ita.0 for ; Mon, 07 May 2018 17:54:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umn.edu; s=google; h=from:to:cc:subject:date:message-id; bh=B0QZYbssoyrs34WuFSxmJW15Bd8PNSgq79QVuQwWx6o=; b=aJp5V141/kGL8tpFz6JD86bI5Lx8kiJvgrnUMFGHi6BG1PZwQdk7J42aI11mB0ySFe GJ4nQod6gyN62SExnxAqTZow/X4c/gmdrIf/s7W04Tt+zFdbfpPAYedAnHq3oVSyqSvC 0nW/SiFTiYVpZ/bqTjPt6kdHxhkp0VdSgspMtP9e6P9hR1tQisMW76afHJDLfLa8uY5E GrF4mz3eqYb0NK7BXipi9e9Q4PZgcJBlndAlrxFYEpyJKJwS/8H77unPhdy8+bZPpPB1 QsirE24WPUlcuG19UakmEjX4qbCTCQL0pfY85SvWrbEapW5+hwqzX6PnTC4x8soz6Xgo QoGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=B0QZYbssoyrs34WuFSxmJW15Bd8PNSgq79QVuQwWx6o=; b=I7vFahkLZzpUsl3TQ+Nc991ICk1pC4adivm269J2ve7pyzYq44HGeramHToGtkZ7VR AUJGpQH9S0ijTUgYzznAI8ZJer7ZRcsrlpUbBosVYQuKCQMoE5eyjfziI9hgxVZGTBBK MsUZ/5A4gGlgYO3Jw9Eq8DXWdFQPBkJNrspfyupe1p91UJ3fmkAgCXVoKAoX5FllMTJk uMc6cs/Y5G8amagScwxB8ucq4FZcSq/y8kwh5cSLHPbTeQ0dflLXkwT4Okm0ntDKNRxD np2/IGRfGuOoZFQH6J9RfCkI958wx+mqyZcKIQZJJxuaysTdLwUu8qCA5bFoHuxuuTwB Pn1w== X-Gm-Message-State: ALQs6tClWKrKrj7DgU4os7yzF9zX8zV13yrGkbeOPghIX1IHHy1nZW3M JhI7XVMeiCJIkjq4xZ6r3HlyVbRkg+kFVVYpbmTg0BR0SSwtGV/FKOBRb1DCwiLHzeUUzsghGvZ eeI16FkTtO/buQfhoA+JY5TbTXg== X-Received: by 2002:a6b:4c1:: with SMTP id 184-v6mr41750502ioe.162.1525740860303; Mon, 07 May 2018 17:54:20 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrDHwrcd3QW0/KiB+e6IHi/xwcE3BxUektDbHPFM2Khlek/oIFTZ6MJLDynsD33EFz68a3abQ== X-Received: by 2002:a6b:4c1:: with SMTP id 184-v6mr41750495ioe.162.1525740860139; Mon, 07 May 2018 17:54:20 -0700 (PDT) Received: from cs-u-cslp16.cs.umn.edu (cs-u-cslp16.cs.umn.edu. [134.84.121.95]) by smtp.gmail.com with ESMTPSA id w142-v6sm4146670ita.21.2018.05.07.17.54.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 07 May 2018 17:54:19 -0700 (PDT) From: Wenwen Wang To: Wenwen Wang Cc: Kangjie Lu , Adam Radford , "James E.J. Bottomley" , "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org (open list) Subject: [PATCH v2] scsi: 3w-xxxx: fix a missing-check bug Date: Mon, 7 May 2018 19:54:01 -0500 Message-Id: <1525740850-23737-1-git-send-email-wang6495@umn.edu> X-Mailer: git-send-email 2.7.4 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In tw_chrdev_ioctl(), the length of the data buffer is firstly copied from the userspace pointer 'argp' and saved to the kernel object 'data_buffer_length'. Then a security check is performed on it to make sure that the length is not more than 'TW_MAX_IOCTL_SECTORS * 512'. Otherwise, an error code -EINVAL is returned. If the security check is passed, the entire ioctl command is copied again from the 'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various operations are performed on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer resides in userspace, a malicious userspace process can race to change the buffer length between the two copies. This way, the user can bypass the security check and inject invalid data buffer length. This can cause potential security issues in the following execution. This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to avoid the above issues. Signed-off-by: Wenwen Wang Acked-by: Adam Radford --- drivers/scsi/3w-xxxx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c index 33261b6..f6179e3 100644 --- a/drivers/scsi/3w-xxxx.c +++ b/drivers/scsi/3w-xxxx.c @@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *inode, struct file *file) dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n"); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + minor_number = iminor(inode); if (minor_number >= tw_device_extension_count) return -ENODEV;