Btrfs: fix access_ok() check in btrfs_ioctl_send()
Subsystems (2)
PATCH 1/1 Btrfs: fix access_ok() check in btrfs_ioctl_send()
The closing parenthesis is in the wrong place. We want to check "sizeof(*arg->clone_sources) * arg->clone_sources_count" instead of "sizeof(*arg->clone_sources * arg->clone_sources_count)".
---
This is also vulnerable to integer overflows. It's only done under root, but these days we are trying to restrict what root can do without configuring Secure Boot in UEFI.
fs/btrfs/send.c +2 -2
@@ -4553,8 +4553,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) }if (!access_ok (VERIFY_READ , arg->clone_sources, -sizeof (*arg->clone_sources * - arg->clone_sources_count))) { +sizeof (*arg->clone_sources) * + arg->clone_sources_count)) { ret = -EFAULT ; goto out; }
Quoted 15 lines · Dan Carpenter
The closing parenthesis is in the wrong place. We want to check "
sizeof(*arg->clone_sources)*arg->clone_sources_count" instead of "sizeof(*arg->clone_sources * arg->clone_sources_count)".Signed-off-by Dan Carpenter <[email protected]>---
This is also vulnerable to integer overflows. It's only done under root, but these days we are trying to restrict what root can do without configuring Secure Boot in UEFI.fs/btrfs/send.c +0
-0
fs/btrfs/send.c long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) · line 4560
Quoted 10 lines
fs/btrfs/send.c +2
-2@@ -4553,8 +4553,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) }if (!access_ok (VERIFY_READ , arg->clone_sources, -sizeof (*arg->clone_sources * - arg->clone_sources_count))) { +sizeof (*arg->clone_sources) * + arg->clone_sources_count)) { ret = -EFAULT ; goto out; }
Thanks,
-Jeff
Quoted 5 lines
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 5 lines · Dan Carpenter
The closing parenthesis is in the wrong place. We want to check "
sizeof(*arg->clone_sources)*arg->clone_sources_count" instead of "sizeof(*arg->clone_sources * arg->clone_sources_count)".Signed-off-by Dan Carpenter <[email protected]>
Original message id: <[email protected]>
This patch hasn't been applied.
Quoted 4 lines
---
This is also vulnerable to integer overflows. It's only done under root, but these days we are trying to restrict what root can do without configuring Secure Boot in UEFI.
Although it's a security fix, it's not exploitable by a user so it's not that urgent to get it merged. Nevertheless, I hope you can squeeze it into 3.12-rc so we can then start pushing it to stable kernels (at least 3.10).
Quoted 5 lines
fs/btrfs/send.c +0
-0
fs/btrfs/send.c long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) · line 4560
Quoted 10 lines
fs/btrfs/send.c +2
-2@@ -4553,8 +4553,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) }if (!access_ok (VERIFY_READ , arg->clone_sources, -sizeof (*arg->clone_sources * - arg->clone_sources_count))) { +sizeof (*arg->clone_sources) * + arg->clone_sources_count)) { ret = -EFAULT ; goto out; }
david
Quoted 10 lines · David Sterba
Quoted 5 lines · Dan Carpenter
The closing parenthesis is in the wrong place. We want to check "
sizeof(*arg->clone_sources)*arg->clone_sources_count" instead of "sizeof(*arg->clone_sources * arg->clone_sources_count)".Signed-off-by Dan Carpenter <[email protected]>Original message id: <[email protected]>
This patch hasn't been applied.
Please add this patch to btrfs-next.
david