Mathieu Desnoyers 3ddc5b46a8 kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() ... I found the following pattern that leads in to interesting findings: grep -r "ret.*|=.*__put_user" * grep -r "ret.*|=.*__get_user" * grep -r "ret.*|=.*__copy" * The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat, since those appear in compat code, we could probably expect the kernel addresses not to be reachable in the lower 32-bit range, so I think they might not be exploitable. For the "__get_user" cases, I don't think those are exploitable: the worse that can happen is that the kernel will copy kernel memory into in-kernel buffers, and will fail immediately afterward. The alpha csum_partial_copy_from_user() seems to be missing the access_ok() check entirely. The fix is inspired from x86. This could lead to information leak on alpha. I also noticed that many architectures map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I wonder if the latter is performing the access checks on every architectures. Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-09-11 15:58:18 -07:00
..
callback_srm.S
checksum.c
clear_page.S
clear_user.S
copy_page.S
copy_user.S
csum_ipv6_magic.S
csum_partial_copy.c	kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()	2013-09-11 15:58:18 -07:00
dbg_current.S
dbg_stackcheck.S
dbg_stackkill.S
dec_and_lock.c	atomic: use <linux/atomic.h>	2011-07-26 16:49:47 -07:00
divide.S
ev6-clear_page.S
ev6-clear_user.S
ev6-copy_page.S
ev6-copy_user.S
ev6-csum_ipv6_magic.S
ev6-divide.S
ev6-memchr.S
ev6-memcpy.S
ev6-memset.S
ev6-stxcpy.S
ev6-stxncpy.S
ev67-strcat.S
ev67-strchr.S
ev67-strlen.S
ev67-strncat.S
ev67-strrchr.S	Fix common misspellings	2011-03-31 11:26:23 -03:00
fls.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
fpreg.c
Makefile	alpha: Use new generic strncpy_from_user() and strnlen_user()	2012-08-19 08:41:18 -07:00
memchr.S
memcpy.c
memmove.S
memset.S
srm_printk.c
srm_puts.c
stacktrace.c	Disintegrate asm/system.h for Alpha	2012-03-28 18:11:12 +01:00
strcat.S
strchr.S
strcpy.S
strlen.S
strncat.S
strncpy.S
strrchr.S	Fix common misspellings	2011-03-31 11:26:23 -03:00
stxcpy.S
stxncpy.S
udelay.c