From patchwork Sun Mar 8 02:38:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 11425405 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 88D4014E3 for ; Sun, 8 Mar 2020 02:41:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 639612070A for ; Sun, 8 Mar 2020 02:41:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583635264; bh=BPtvgaMeJv/7+wbzTP9+Rt7/Uf1D7JLT0hjpTXsJ53Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IyLdDE0dix91bp+7/+OW8AZAYpWcMdD6k4nlZfPgxPrjjWLgLaLl0GbbyoFzXR0AT 2/a8lnHtAwWE5hsW0daJ+caZcKzrB8sVp5OoYBQ4DsYh487dFOeYpXtULwBl6lmEzc D2AoB/J+gy/9I5waBJ2fSPP7MttQ5LxL6/PMn3gI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726298AbgCHCk0 (ORCPT ); Sat, 7 Mar 2020 21:40:26 -0500 Received: from mail.kernel.org ([198.145.29.99]:35468 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726284AbgCHCk0 (ORCPT ); Sat, 7 Mar 2020 21:40:26 -0500 Received: from sol.hsd1.ca.comcast.net (c-107-3-166-239.hsd1.ca.comcast.net [107.3.166.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C19AC2070A; Sun, 8 Mar 2020 02:40:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583635226; bh=BPtvgaMeJv/7+wbzTP9+Rt7/Uf1D7JLT0hjpTXsJ53Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w9g/UFgDcfUEx8nRARyA6ndQRVnHUX3u6hozDBqtWlc249Q8kAfovksCNVMk+PPFk hiq3st+xKpSXbsnz9lkZyzENnRsOSD+OaWcHO2CWNd4oA61YdmfIqRaUTFqN/+vo+0 mC3b3GtebYk6N2/2tou71NgklaZ8dN9Uf67fLbUQ= From: Eric Biggers To: linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk Cc: glider@google.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org, syzbot+fcab69d1ada3e8d6f06b@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com Subject: [PATCH] libfs: fix infoleak in simple_attr_read() Date: Sat, 7 Mar 2020 18:38:49 -0800 Message-Id: <20200308023849.988264-1-ebiggers@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org From: Eric Biggers Reading from a debugfs file at a nonzero position, without first reading at position 0, leaks uninitialized memory to userspace. It's a bit tricky to do this, since lseek() and pread() aren't allowed on these files, and write() doesn't update the position on them. But writing to them with splice() *does* update the position: #define _GNU_SOURCE 1 #include #include #include int main() { int pipes[2], fd, n, i; char buf[32]; pipe(pipes); write(pipes[1], "0", 1); fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR); splice(pipes[0], NULL, fd, NULL, 1, 0); n = read(fd, buf, sizeof(buf)); for (i = 0; i < n; i++) printf("%02x", buf[i]); printf("\n"); } Output: 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30 Fix the infoleak by making simple_attr_read() always fill simple_attr::get_buf if it hasn't been filled yet. Reported-by: syzbot+fcab69d1ada3e8d6f06b@syzkaller.appspotmail.com Reported-by: Alexander Potapenko Fixes: acaefc25d21f ("[PATCH] libfs: add simple attribute files") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Kees Cook --- fs/libfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/libfs.c b/fs/libfs.c index c686bd9caac6..3759fbacf522 100644 --- a/fs/libfs.c +++ b/fs/libfs.c @@ -891,7 +891,7 @@ int simple_attr_open(struct inode *inode, struct file *file, { struct simple_attr *attr; - attr = kmalloc(sizeof(*attr), GFP_KERNEL); + attr = kzalloc(sizeof(*attr), GFP_KERNEL); if (!attr) return -ENOMEM; @@ -931,9 +931,11 @@ ssize_t simple_attr_read(struct file *file, char __user *buf, if (ret) return ret; - if (*ppos) { /* continued read */ + if (*ppos && attr->get_buf[0]) { + /* continued read */ size = strlen(attr->get_buf); - } else { /* first read */ + } else { + /* first read */ u64 val; ret = attr->get(attr->data, &val); if (ret)