Wenwen Wang 4cc537f4a9 dm ioctl: harden copy_params()'s copy_from_user() from malicious users ... commit 800a7340ab7dd667edf95e74d8e4f23a17e87076 upstream. In copy_params(), the struct 'dm_ioctl' is first copied from the user space buffer 'user' to 'param_kernel' and the field 'data_size' is checked against 'minimum_data_size' (size of 'struct dm_ioctl' payload up to its 'data' member). If the check fails, an error code EINVAL will be returned. Otherwise, param_kernel->data_size is used to do a second copy, which copies from the same user-space buffer to 'dmi'. After the second copy, only 'dmi->data_size' is checked against 'param_kernel->data_size'. Given that the buffer 'user' resides in the user space, a malicious user-space process can race to change the content in the buffer between the two copies. This way, the attacker can inject inconsistent data into 'dmi' (versus previously validated 'param_kernel'). Fix redundant copying of 'minimum_data_size' from user-space buffer by using the first copy stored in 'param_kernel'. Also remove the 'data_size' check after the second copy because it is now unnecessary. Cc: stable@vger.kernel.org Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-21 09:27:36 +01:00
..
bcache	bcache: fix miss key refill->end in writeback	2018-11-21 09:27:30 +01:00
persistent-data	dm btree: fix serious bug in btree_split_beneath()	2018-01-23 19:50:16 +01:00
bitmap.c	md/bitmap: disable bitmap_resize for file-backed bitmaps.	2017-09-27 11:00:14 +02:00
bitmap.h	md-cluster: Use a small window for resync	2015-10-12 01:32:05 -05:00
dm-bio-prison.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm-bio-prison.h	dm bio prison: add dm_cell_promote_or_release()	2015-05-29 14:19:06 -04:00
dm-bio-record.h
dm-bufio.c	dm bufio: don't take the lock in dm_bufio_shrink_count	2018-07-11 16:03:51 +02:00
dm-bufio.h
dm-builtin.c
dm-cache-block-types.h
dm-cache-metadata.c	dm cache metadata: save in-core policy_hint_size to on-disk superblock	2018-09-09 20:04:33 +02:00
dm-cache-metadata.h	dm cache: make sure every metadata function checks fail_io	2016-04-12 09:08:40 -07:00
dm-cache-policy-cleaner.c	- Revert a dm-multipath change that caused a regression for unprivledged	2015-11-04 21:19:53 -08:00
dm-cache-policy-internal.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-policy-mq.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-cache-policy-smq.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-cache-policy.c
dm-cache-policy.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-target.c	dm cache: fix resize crash if user doesn't reload cache table	2018-10-13 09:11:32 +02:00
dm-crypt.c	dm crypt: mark key as invalid until properly loaded	2017-01-06 11:16:15 +01:00
dm-delay.c	dm delay: document that offsets are specified in sectors	2015-10-31 19:06:05 -04:00
dm-era-target.c	dm era: save spacemap metadata root after the pre-commit	2017-05-20 14:27:00 +02:00
dm-exception-store.c	- Revert a dm-multipath change that caused a regression for unprivledged	2015-11-04 21:19:53 -08:00
dm-exception-store.h	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-flakey.c	dm flakey: return -EINVAL on interval bounds error in flakey_ctr()	2017-01-06 11:16:15 +01:00
dm-io.c	dm io: fix duplicate bio completion due to missing ref count	2018-03-11 16:19:47 +01:00
dm-ioctl.c	dm ioctl: harden copy_params()'s copy_from_user() from malicious users	2018-11-21 09:27:36 +01:00
dm-kcopyd.c	dm kcopyd: avoid softlockup in run_complete_job	2018-09-15 09:40:39 +02:00
dm-linear.c	dm linear: remove redundant target name from error messages	2015-10-31 19:06:03 -04:00
dm-log-userspace-base.c	dm: drop NULL test before kmem_cache_destroy() and mempool_destroy()	2015-10-31 19:06:00 -04:00
dm-log-userspace-transfer.c	dm log userspace transfer: match wait_for_completion_timeout return type	2015-04-15 12:10:20 -04:00
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: fix bug with too large bios	2016-10-07 15:23:47 +02:00
dm-log.c
dm-mpath.c	dm mpath: check if path's request_queue is dying in activate_path()	2016-10-28 03:01:28 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c	dm raid: fix round up of default region size	2015-10-02 12:02:31 -04:00
dm-raid1.c	dm mirror: fix read error on recovery after default leg failure	2016-11-10 16:36:35 +01:00
dm-region-hash.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-snap-transient.c	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-snap.c	dm snapshot: disallow the COW and origin devices from being identical	2016-04-12 09:08:39 -07:00
dm-stats.c	dm stats: fix a leaked s->histogram_boundaries array	2017-03-12 06:37:26 +01:00
dm-stats.h	dm stats: support precise timestamps	2015-06-17 12:40:40 -04:00
dm-stripe.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-switch.c	dm switch: simplify conditional in alloc_region_table()	2015-10-31 19:06:06 -04:00
dm-sysfs.c	dm: add 'use_blk_mq' module param and expose in per-device ro sysfs attr	2015-04-15 12:10:17 -04:00
dm-table.c	dm snapshot: disallow the COW and origin devices from being identical	2016-04-12 09:08:39 -07:00
dm-target.c
dm-thin-metadata.c	dm thin metadata: fix __udivdi3 undefined on 32-bit	2018-10-10 08:52:13 +02:00
dm-thin-metadata.h	dm thin metadata: add dm_thin_remove_range()	2015-06-11 17:13:04 -04:00
dm-thin.c	dm thin metadata: try to avoid ever aborting transactions	2018-10-10 08:52:12 +02:00
dm-uevent.c
dm-uevent.h
dm-verity.c	dm: refactor ioctl handling	2015-10-31 19:05:59 -04:00
dm-zero.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm.c	dm: correctly handle chained bios in dec_pending()	2018-02-22 15:45:01 +01:00
dm.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
faulty.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
Kconfig	dm raid: select the Kconfig option CONFIG_MD_RAID0	2017-05-25 14:30:07 +02:00
linear.c	md/linear: shutup lockdep warnning	2017-10-21 17:09:05 +02:00
linear.h	md linear: fix a race between linear_add() and linear_congested()	2017-03-12 06:37:30 +01:00
Makefile	raid5: add basic stripe log	2015-10-24 17:16:19 +11:00
md-cluster.c	md-cluster: clear another node's suspend_area after the copy is finished	2018-10-10 08:52:04 +02:00
md-cluster.h	md-cluster: Fix adding of new disk with new reload code	2015-10-12 03:35:30 -05:00
md.c	MD: fix invalid stored role for a disk	2018-11-21 09:27:33 +01:00
md.h	md/raid: only permit hot-add of compatible integrity profiles	2016-02-17 12:30:57 -08:00
multipath.c	md: multipath: don't hardcopy bio in .make_request path	2016-04-12 09:08:57 -07:00
multipath.h
raid0.c	md/raid0: apply base queue limits *before* disk_stack_limits	2015-10-02 17:23:44 +10:00
raid0.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
raid1.c	md/raid1: fix NULL pointer dereference	2018-05-30 07:49:01 +02:00
raid1.h	md-cluster: Use a small window for resync	2015-10-12 01:32:05 -05:00
raid5-cache.c	raid5-cache: start raid5 readonly if journal is missing	2015-11-01 13:48:29 +11:00
raid5.c	md/raid5: fix data corruption of replacements after originals dropped	2018-09-19 22:48:57 +02:00
raid5.h	RAID5: revert e9e4c377e2 to fix a livelock	2016-04-12 09:08:57 -07:00
raid10.c	RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0	2018-10-10 08:52:11 +02:00
raid10.h	md/raid10: ensure device failure recorded before write request returns.	2015-08-31 19:43:45 +02:00